CVE-2022-2185: GitLab Project Import RCE Vulnerability

CVE-2022-2185 Overview

A critical remote code execution vulnerability has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. This vulnerability allows an authenticated user authorized to import projects to import a maliciously crafted project, leading to remote code execution on the GitLab server. The flaw is classified as CWE-78 (OS Command Injection), enabling attackers to execute arbitrary system commands through the project import functionality.

Critical Impact

Authenticated attackers can achieve remote code execution on GitLab servers by importing a specially crafted project, potentially compromising the entire GitLab instance and any connected CI/CD pipelines.

Affected Products

• GitLab Community Edition versions 14.0 to 14.10.4
• GitLab Enterprise Edition versions 14.0 to 14.10.4
• GitLab Community Edition versions 15.0 to 15.0.3
• GitLab Enterprise Edition versions 15.0 to 15.0.3
• GitLab Community Edition version 15.1.0
• GitLab Enterprise Edition version 15.1.0

Discovery Timeline

• 2022-07-01 - CVE-2022-2185 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-2185

Vulnerability Analysis

This vulnerability exists within GitLab's project import functionality and is classified as an OS Command Injection vulnerability (CWE-78). The flaw allows authenticated users with project import permissions to execute arbitrary commands on the underlying server by crafting a malicious project export file. When GitLab processes the import, insufficient sanitization of input data allows command injection through the import pipeline.

The vulnerability is particularly dangerous because it requires only low-privilege authenticated access—any user with the ability to import projects can potentially exploit this flaw. The attack can be executed remotely over the network without user interaction, and successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2022-2185 lies in improper input validation and sanitization within GitLab's project import processing logic. When handling project export files, the application fails to properly sanitize user-controlled data before passing it to system commands. This allows specially crafted project files to inject arbitrary OS commands that are then executed with the privileges of the GitLab application process.

Attack Vector

The attack requires an authenticated user account with permissions to import projects. The attacker creates a maliciously crafted project export file containing embedded command injection payloads. When this file is uploaded and processed through GitLab's project import feature, the injected commands are executed on the server.

The attack flow involves:

1. Creating a specially crafted project export archive
2. Embedding command injection payloads in project metadata or file contents
3. Uploading the malicious export file via GitLab's project import functionality
4. Triggering command execution during the import processing pipeline

For technical details on the exploitation mechanism, refer to the HackerOne Vulnerability Report and GitLab Issue Discussion.

Detection Methods for CVE-2022-2185

Indicators of Compromise

• Unusual project import activities from user accounts, especially imports followed by suspicious server behavior
• Unexpected child processes spawned by GitLab application processes (Puma, Sidekiq workers)
• Anomalous network connections originating from GitLab server processes
• Unusual file system modifications in GitLab directories or system locations
• Evidence of command execution in GitLab application logs during import operations

Detection Strategies

• Monitor GitLab audit logs for unusual project import activity patterns
• Implement process monitoring on GitLab servers to detect unexpected command execution from GitLab processes
• Review Sidekiq job logs for anomalies during project import jobs
• Deploy endpoint detection solutions to identify suspicious process trees originating from GitLab services

Monitoring Recommendations

• Enable comprehensive audit logging for all project import operations
• Configure alerting for failed or suspicious import attempts
• Monitor system resource utilization during import operations for anomalies
• Implement network traffic analysis for unexpected outbound connections from GitLab servers

How to Mitigate CVE-2022-2185

Immediate Actions Required

• Upgrade GitLab to version 14.10.5, 15.0.4, or 15.1.1 or later immediately
• Review recent project import activity for signs of exploitation
• Audit user accounts with project import permissions and restrict access where possible
• Consider temporarily disabling project import functionality until patching is complete

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• GitLab 14.10.5 for installations on the 14.x branch
• GitLab 15.0.4 for installations on the 15.0.x branch
• GitLab 15.1.1 for installations on the 15.1.x branch

Refer to the GitLab CVE Detail for official patch information and security advisory details.

Workarounds

• Restrict project import permissions to only trusted administrator accounts
• Implement network segmentation to limit the impact of potential RCE
• Deploy web application firewalls (WAF) with rules to detect malicious import payloads
• Enable enhanced audit logging and monitoring for project import operations

# Restrict project import permissions in GitLab settings
# Navigate to Admin Area > Settings > General > Visibility and access controls
# Disable or restrict "Project import sources" to limit exposure
# Alternatively, use GitLab Rails console to disable imports:
gitlab-rails console
# In console:
# ApplicationSetting.current.update!(import_sources: [])