CVE-2021-22205
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Description
CVE-2021-22205 is a CRITICAL remote code execution vulnerability in GitLab Community and Enterprise Editions with a maximum CVSS 3.1 score of 10.0. The vulnerability exists in GitLab Workhorse, which passes uploaded image files through ExifTool without proper validation. An attacker can upload a specially crafted image file containing malicious metadata that triggers command injection in ExifTool, achieving unauthenticated remote code execution. All GitLab versions from 11.9 are affected. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. The EPSS score of 0.94467 (99.995th percentile) confirms widespread exploitation, and the vulnerability has been associated with ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | >= 11.9.0, < 13.8.8; >= 13.9.0, < 13.9.6; >= 13.10.0, < 13.10.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json(Vendor Advisory)
- https://gitlab.com/gitlab-org/gitlab/-/issues/327121(Broken Link)
- https://hackerone.com/reports/1154542(Permissions Required, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2021-22205 is classified under CWE-94 — Improper Control of Generation of Code (Code Injection). This weakness occurs when software constructs code segments using externally-influenced input but fails to neutralize special elements that could modify the syntax or behavior of the generated code. Code injection differs from command injection in that the injected code is executed within the application's own runtime or an embedded interpreter.
In the context of GitLab, the vulnerability specifically targeted ExifTool's handling of DjVu file metadata. GitLab Workhorse processed uploaded images through ExifTool to strip EXIF metadata, but ExifTool contained a vulnerability that allowed specially crafted DjVu files to inject and execute arbitrary Perl code during metadata parsing. Because GitLab accepted image uploads without requiring authentication in certain configurations, this created an unauthenticated remote code execution path with the maximum possible severity.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2021-22205 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Complete access to all data stored in the GitLab instance, including source code repositories, CI/CD secrets, API tokens, SSH keys, user credentials, and any sensitive intellectual property hosted on the platform.
Integrity (HIGH): Attackers can modify source code repositories, tamper with CI/CD pipelines to inject malicious code into build artifacts, alter user permissions, and plant backdoors throughout the development infrastructure.
Availability (HIGH): Full denial of service is possible, including shutting down the GitLab instance, encrypting repositories for ransomware, corrupting databases, or leveraging the server for further attacks.
Scope Changed: The Changed scope (C) means that exploitation of the GitLab component can impact resources beyond the vulnerable component itself. An attacker who compromises the GitLab server can pivot to connected systems, CI/CD runners, deployment targets, and the broader development infrastructure.
The EPSS score of 0.94467 (99.995th percentile) places this among the most actively exploited vulnerabilities globally, with confirmed botnet activity targeting exposed GitLab instances.
Exploit Maturity
CVE-2021-22205 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploits are widely available, including Metasploit modules and standalone proof-of-concept scripts. Exploitation requires only the ability to upload a file to the GitLab instance, and in many configurations this does not require authentication. The exploit leverages a vulnerability in ExifTool (CVE-2021-22204) as the underlying mechanism.
Ransomware association: This vulnerability has been confirmed as associated with ransomware campaigns. Threat actors have targeted internet-exposed GitLab instances to deploy ransomware and extort organizations by threatening to destroy or publish proprietary source code.
Attack surface: Internet-facing GitLab instances are directly exposed. Security researchers identified thousands of vulnerable instances via internet scanning. Botnets were observed mass-exploiting this vulnerability to install cryptominers, web shells, and other malware. The EPSS score of 0.94467 (99.995th percentile) reflects the extreme exploitation activity.
KEV deadline: CISA required remediation by 2021-11-17, with only a 14-day window, reflecting the urgency of this threat.
Remediation
- Update GitLab immediately. Upgrade to GitLab 13.8.8, 13.9.6, 13.10.3, or any later version. Consult the GitLab security advisory and the CVE-2021-22205 disclosure for detailed guidance.
- Identify all GitLab installations in your environment. Locate every GitLab instance, including self-managed installations on development servers, staging environments, and cloud deployments. Affected versions span from 11.9.0 through 13.10.2.
- Restrict network access to GitLab instances. Ensure GitLab is not unnecessarily exposed to the internet. Place instances behind VPN or firewall controls. Disable unauthenticated file uploads if possible.
- Check for indicators of compromise. Review GitLab logs for suspicious file upload activity, unexpected process execution (particularly ExifTool-related), and unauthorized repository access. Look for web shells, cryptominers, or new SSH keys added to accounts.
- Update ExifTool independently. Ensure the ExifTool installation used by GitLab is updated to version 12.24 or later, which patches the underlying CVE-2021-22204.
- Rotate credentials and secrets. If compromise is suspected, rotate all credentials stored in GitLab including CI/CD variables, deploy tokens, API keys, and user passwords. Review repository commit history for unauthorized changes.
Technical Details
CVE-2021-22205 is a CRITICAL vulnerability with the maximum CVSS score of 10.0, exploitable remotely without authentication or user interaction. The Changed scope indicates impact beyond the vulnerable component.
Technical mechanism: GitLab Workhorse, the component that handles file uploads, passes image files through ExifTool for metadata stripping. ExifTool versions before 12.24 contained a vulnerability in the DjVu file format parser (CVE-2021-22204) that allowed arbitrary Perl code execution through specially crafted metadata fields. By uploading a malicious DjVu file disguised as a legitimate image, an attacker triggers code execution in the context of the GitLab server.
Attack flow: The attacker crafts a DjVu file containing malicious Perl code embedded in the metadata annotations field. This file is uploaded to a GitLab endpoint that processes images (such as issue descriptions, comments, or project avatars). GitLab Workhorse invokes ExifTool to process the file, which parses the DjVu metadata and executes the embedded Perl code with the permissions of the GitLab service account.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): Network attack vector, low complexity, no privileges needed, no user interaction. The Changed scope (S:C) reflects that compromising GitLab can impact connected systems including CI/CD runners and deployment targets.
Affected products: GitLab CE/EE (>= 11.9.0, < 13.8.8), GitLab CE/EE (>= 13.9.0, < 13.9.6), GitLab CE/EE (>= 13.10.0, < 13.10.3).
Frequently Asked Questions
Is CVE-2021-22205 being actively exploited?
Yes, CVE-2021-22205 is massively exploited in the wild. It was added to CISA's KEV catalog with an unusually short 14-day remediation deadline, reflecting extreme urgency. Botnets have been observed scanning for and automatically exploiting vulnerable GitLab instances. The EPSS score of 0.94467 (99.995th percentile) confirms it as one of the most exploited vulnerabilities globally. It has been linked to ransomware and cryptomining campaigns.
What products are affected by CVE-2021-22205?
All GitLab Community Edition and Enterprise Edition versions from 11.9.0 are affected. Specifically, versions before 13.8.8, 13.9.x before 13.9.6, and 13.10.x before 13.10.3 are vulnerable. Both self-managed and dedicated installations are impacted. GitLab.com (SaaS) was patched by GitLab directly.
How do I fix CVE-2021-22205?
Upgrade GitLab to version 13.8.8, 13.9.6, 13.10.3, or later. Additionally, update ExifTool to version 12.24 or later. Restrict network access to GitLab instances and disable unauthenticated uploads where possible. If patching was delayed, perform a forensic review and rotate all stored credentials and secrets.
How severe is CVE-2021-22205?
CVE-2021-22205 has the maximum CVSS score of 10.0 (CRITICAL) with Changed scope, meaning exploitation can affect systems beyond GitLab itself. It allows unauthenticated remote code execution and has confirmed ransomware associations. CISA set one of its shortest-ever remediation deadlines (14 days) for this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.