{"uuid": "b0178615-35e6-4d63-a4bd-018be3e19f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22205", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"William Bowling\", \"jbaines-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated file upload and command\\n          injection vulnerability in GitLab Community Edition (CE) and\\n          Enterprise Edition (EE). The patched versions are 13.10.3, 13.9.6,\\n          and 13.8.8.\\n\\n          Exploitation will result in command execution as the git user.\", \"disclosure_date\": \"2021-04-14\", \"fullname\": \"exploit/multi/http/gitlab_exif_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"GitLab Unauthenticated Remote ExifTool Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/gitlab_exif_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/gitlab_exif_rce\", \"references\": [\"CVE-2021-22205\", \"CVE-2021-22204\", \"URL-https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/\", \"URL-https://hackerone.com/reports/1154542\", \"URL-https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis\", \"URL-https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:48.671607Z"}