CVE-2021-22205

What is GitLab?

GitLab Community Edition (CE) and Enterprise Edition (EE) are widely deployed source code management and DevOps platforms used by enterprises, government agencies, and software development organizations to host Git repositories, manage CI/CD pipelines, and coordinate software development. Self-hosted GitLab instances contain source code for all of an organization's software projects — compromising GitLab provides access to intellectual property, credentials embedded in code, CI/CD pipeline secrets, and the ability to inject malicious code into software builds. GitLab is one of the highest-value targets for both espionage actors and ransomware operators.

Overview

CVE-2021-22205 is a remote code execution vulnerability (CWE-94, code injection) in GitLab CE/EE arising from an unsafe dependency on ExifTool (CVE-2021-22204) for image file processing. When users upload images through the GitLab Workhorse component, Workhorse passes the files to ExifTool to extract and strip metadata. ExifTool had an arbitrary code execution vulnerability in its parsing of DjVu files — specially crafted files with malicious metadata trigger shell command execution. Because GitLab Workhorse invoked ExifTool without sandboxing, the exploit results in code execution on the GitLab server without any authentication. GitLab patched in April 2021, but mass exploitation did not begin until October 2021 — six months later — when public proof-of-concept code became widely available. At peak exploitation, an estimated 50% of internet-exposed GitLab instances remained unpatched.

Affected Versions

Technical Details

The attack chain combines two vulnerabilities: GitLab's use of ExifTool and ExifTool's own code injection bug:

• Root cause: Code injection (CWE-94) — ExifTool (CVE-2021-22204) parses DjVu files and evaluates Perl code embedded in certain metadata fields without sanitization. GitLab Workhorse invokes ExifTool on all uploaded image files
• Attack path: Attacker uploads a specially crafted file (disguised as an image but containing malicious DjVu metadata) to any GitLab endpoint that accepts file uploads — including unauthenticated endpoints (e.g., the user registration avatar upload)
• Authentication required: None — GitLab Workhorse processes uploads before authentication is checked on some endpoints, making this a zero-auth exploit
• Scope: Changed — The exploit escapes the context of GitLab's file upload handling to execute OS commands on the server hosting GitLab
• Code execution context: Commands run as the GitLab application user (git) on self-hosted installations, giving access to all GitLab data, configuration files, and secrets

Discovery

The underlying ExifTool vulnerability (CVE-2021-22204) was discovered by security researcher William Bowling. GitLab's exposure was identified when researchers realized that GitLab Workhorse called ExifTool on uploaded files without sandboxing. GitLab issued an emergency patch in April 2021.

Exploitation Context

Despite the April 2021 patch, mass exploitation began in earnest in late October 2021 following the publication of ready-to-use proof-of-concept exploit code. Threat actors deployed cryptominers, webshells, and ransomware on compromised GitLab instances. The source code repositories accessible after compromise represent a secondary impact: stolen source code, embedded credentials, and injected backdoors in CI/CD pipelines can have cascading effects long after the initial intrusion. Rapid7 analysis confirmed active exploitation across hundreds of GitLab instances globally.

Remediation

1. Update GitLab to version 13.10.3, 13.9.6, or 13.8.8 — or any later version
2. Check for unauthorized webshells in the GitLab installation directory and uploaded file storage
3. Review GitLab audit logs for unexpected repository access, pipeline changes, or new user registrations
4. Rotate all GitLab application secrets, runner tokens, and any credentials stored in CI/CD variables
5. Audit all repositories for unauthorized commits or modified .gitlab-ci.yml files that could inject malicious build steps
6. Restrict network access to GitLab — self-hosted GitLab instances should not be directly internet-accessible unless necessary; use VPN or allowlisted IP ranges