CVE-2021-22205 PoC — GitLab 代码注入漏洞

介绍

## Unauthenticated RCE on Gitlab version < 13.10.3

Unauthenticated RCE exploit for gitlab version < 13.10.3

**For educational/research purpose only. Use at your own risk**


Root cause:
- When uploading image files, Gitlab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags.
- One of the supported formats is DjVu. When parsing the DjVu annotation, the tokens are evaled to "convert C escape sequences".
- Author's write-up: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

```
# convert C escape sequences (allowed in quoted text)
$tok = eval qq{"$tok"};
```
### Credits
- Reported by: https://hackerone.com/reports/1154542
- Refered some code from here: https://github.com/CsEnox/GitLab-Wiki-RCE
- Author's write up: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

### Usage

Need install `djvumake` & `djvulibre` to work 

Install djvulibre ( if you haven't installed it yet)
```
sudo apt-get install -y djvulibre-bin
```

Run exploit

```
python3 exploit.py -t <gitlab_url> -c <command>
```


Tested on version 13.10.1-ce.0

文件快照

备注