CVE-2021-22205: GitLab CE/EE RCE Vulnerability

CVE-2021-22205 Overview

CVE-2021-22205 is a critical remote code execution vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from 11.9. The vulnerability stems from improper validation of image files passed to a file parser, specifically the ExifTool library, which allows unauthenticated attackers to execute arbitrary commands on the underlying server.

Critical Impact

This vulnerability allows unauthenticated remote command execution on GitLab servers, enabling complete system compromise without any user interaction. It has been added to CISA's Known Exploited Vulnerabilities Catalog due to active exploitation in the wild.

Affected Products

• GitLab Community Edition (CE) versions 11.9 and later
• GitLab Enterprise Edition (EE) versions 11.9 and later
• All unpatched GitLab installations prior to security fixes

Discovery Timeline

• 2021-04-23 - CVE-2021-22205 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2021-22205

Vulnerability Analysis

This vulnerability is classified as a Command Injection (CWE-94: Improper Control of Generation of Code) that enables unauthenticated remote code execution. The flaw exists in how GitLab handles image file uploads through its integration with ExifTool, a Perl-based application used for reading, writing, and editing metadata in image files.

When users upload images to GitLab repositories or through various GitLab features, the application processes these files using ExifTool to extract metadata. However, GitLab failed to properly validate and sanitize image files before passing them to the ExifTool parser. This oversight allows attackers to craft malicious image files containing embedded commands that execute on the server when ExifTool processes them.

The attack can be performed without authentication, making it particularly dangerous for any internet-facing GitLab instance. Given the widespread enterprise deployment of GitLab for source code management, successful exploitation could lead to source code theft, supply chain attacks, lateral movement within corporate networks, and complete infrastructure compromise.

Root Cause

The root cause of CVE-2021-22205 lies in insufficient input validation of uploaded image files combined with a vulnerable version of ExifTool. GitLab's image processing pipeline accepted user-supplied image files and passed them directly to ExifTool without adequate sanitization. The underlying ExifTool vulnerability (CVE-2021-22204) allowed specially crafted DjVu files to execute arbitrary code through improper handling of DjVu annotations.

When GitLab processed these malicious files, the embedded payloads within the image metadata were interpreted and executed by the ExifTool Perl interpreter, resulting in command execution with the privileges of the GitLab service user.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it highly exploitable. Attackers can exploit this vulnerability by:

1. Crafting a malicious DjVu image file with embedded command injection payloads in the metadata
2. Uploading the malicious file to a GitLab instance through any file upload endpoint (issues, snippets, projects)
3. When GitLab processes the image through ExifTool, the embedded commands execute on the server

The vulnerability can be triggered through multiple GitLab features that accept image uploads, including project repositories, issue attachments, and user avatars. Successful exploitation grants attackers the ability to execute commands as the git user, potentially leading to full system compromise.

Detailed technical information about the exploitation mechanism is available in the Packet Storm Command Injection Advisory and the HackerOne Vulnerability Report.

Detection Methods for CVE-2021-22205

Indicators of Compromise

• Unusual process spawning from the GitLab git or gitlab-rails user, particularly shell processes or unexpected child processes of Ruby/Puma workers
• Suspicious file uploads with DjVu (.djvu) or other image file extensions containing abnormal metadata
• Web server access logs showing POST requests to GitLab upload endpoints with unusual payloads or from suspicious IP addresses
• Unexpected outbound network connections from the GitLab server, especially reverse shells or data exfiltration attempts
• Modified system files or new unauthorized user accounts created on the GitLab server

Detection Strategies

• Monitor GitLab web server logs for unusual POST requests to file upload endpoints, particularly those containing image files from untrusted sources
• Implement file integrity monitoring on GitLab server directories to detect unauthorized modifications
• Deploy network intrusion detection rules to identify command injection patterns in HTTP traffic destined for GitLab instances
• Monitor for ExifTool process execution with suspicious command-line arguments or unusual parent processes

Monitoring Recommendations

• Enable verbose logging for GitLab application and web server components to capture upload activity
• Configure alerts for any child process spawned by GitLab worker processes that are not part of normal operations
• Monitor system calls and process creation on GitLab servers using endpoint detection tools
• Review GitLab audit logs regularly for anomalous file upload patterns or access from unexpected geographic locations

How to Mitigate CVE-2021-22205

Immediate Actions Required

• Upgrade GitLab CE/EE to the latest patched version immediately; this is the most effective remediation
• If immediate patching is not possible, disable file uploads or restrict access to upload functionality until the patch can be applied
• Audit GitLab servers for signs of compromise, including unauthorized user accounts, modified files, and suspicious processes
• Review network firewall rules to restrict unnecessary inbound access to GitLab instances

Patch Information

GitLab has released security patches to address CVE-2021-22205. Organizations should upgrade to the latest stable version of GitLab CE or EE. Detailed patch information and affected version ranges are available in the GitLab CVE-2021-22205 Advisory.

The fix involves proper validation of uploaded image files and updating the bundled ExifTool to a non-vulnerable version. GitLab also implemented additional input sanitization to prevent similar file parsing vulnerabilities.

Workarounds

• Disable GitLab's image processing functionality by blocking ExifTool execution if patching cannot be performed immediately
• Implement network-level restrictions to limit access to GitLab upload endpoints to trusted internal networks only
• Deploy a Web Application Firewall (WAF) with rules to inspect and block malicious file uploads
• Consider taking vulnerable GitLab instances offline until patches can be applied, especially for internet-facing deployments

# Verify GitLab version to check if patched
gitlab-rake gitlab:env:info | grep "GitLab information"

# Check ExifTool version bundled with GitLab
/opt/gitlab/embedded/bin/exiftool -ver

# Restrict file upload directory permissions as a temporary measure
chmod 750 /var/opt/gitlab/gitlab-rails/uploads