CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
First published: Fri Apr 23 2021(Updated: )
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
Credit: cve@gitlab.com cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=11.9.0<13.8.8 | |
| GitLab | >=11.9.0<13.8.8 | |
| GitLab | >=13.9.0<13.9.6 | |
| GitLab | >=13.9.0<13.9.6 | |
| GitLab | >=13.10.0<13.10.3 | |
| GitLab | >=13.10.0<13.10.3 | |
| GitLab | ||
| >=11.9.0<13.8.8 | ||
| >=11.9.0<13.8.8 | ||
| >=13.9.0<13.9.6 | ||
| >=13.9.0<13.9.6 | ||
| >=13.10.0<13.10.3 | ||
| >=13.10.0<13.10.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json
- https://gitlab.com/gitlab-org/gitlab/-/issues/327121
- https://hackerone.com/reports/1154542
- https://nvd.nist.gov/vuln/detail/CVE-2021-22205
Frequently Asked Questions
What is the severity of CVE-2021-22205?
CVE-2021-22205 is classified as critical due to its potential for remote code execution.
How do I fix CVE-2021-22205?
To remediate CVE-2021-22205, upgrade GitLab Community and Enterprise Editions to versions 13.10.3, 13.9.6, or 13.8.8 or later.
What versions of GitLab are affected by CVE-2021-22205?
CVE-2021-22205 affects GitLab versions ranging from 11.9.0 to 13.8.8 and some versions between 13.9.0 to 13.9.6 and 13.10.0 to 13.10.3.
What type of vulnerability is CVE-2021-22205?
CVE-2021-22205 is a remote code execution vulnerability due to improper validation of image file extensions.
Who is affected by CVE-2021-22205?
Organizations using GitLab Community and Enterprise Editions with the image upload feature enabled are vulnerable to CVE-2021-22205.
- agent/type
- agent/description
- agent/weakness
- agent/title
- agent/severity
- agent/first-publish-date
- agent/author
- agent/references
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- vendor/gitlab
- canonical/gitlab
- version/gitlab/11.9.0
- version/gitlab/13.9.0
- version/gitlab/13.10.0