exploit/multi/http/gitlab_exif_rce

weaponized

GitLab Unauthenticated Remote ExifTool Command Injection

view exploit source metasploittype exploitpublished 2021-04-14catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2021-22205US	critical10.0OT critical	99.7% (100th)	KEV	2021-04-23
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resul…
CVE-2021-22204US	high7.8OT critical	100.0% (100th)	KEV	2021-04-23
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.