CVE-2021-22205: 
GitLab vulnerability analysis and mitigation

CVE-2021-22205 is a critical vulnerability discovered in GitLab CE/EE affecting all versions starting from 11.9. The vulnerability stems from improper validation of image files that were passed to a third-party file parser ExifTool, resulting in a remote command execution vulnerability. The issue was discovered in early 2021 and was patched in GitLab versions 13.10.3, 13.9.6, and 13.8.8 released on April 14, 2021 (GitLab Release, GitLab Blog).

The vulnerability occurs when GitLab Workhorse passes files with jpg|jpeg|tiff extensions through ExifTool for metadata removal. ExifTool ignores file extensions and determines file type based on content, allowing attackers to exploit other supported parsers. The vulnerability specifically involves the DjVu format parser, where tokens are evaluated to convert C escape sequences, leading to command execution. The issue received a CVSS score of 10.0, upgraded from its initial score of 9.9 after being reclassified from an authenticated to an unauthenticated vulnerability (Rapid7 Blog).

The vulnerability allows remote attackers to execute arbitrary commands as the git user through specially crafted image files. This could lead to complete compromise of the GitLab instance. The issue affects both GitLab Community Edition (CE) and Enterprise Edition (EE), with confirmed reports of exploitation in the wild on self-managed public-facing GitLab instances (GitLab Blog).

GitLab released patches in versions 13.10.3, 13.9.6, and 13.8.8. Users are strongly advised to upgrade to these or newer versions immediately. For those unable to upgrade quickly, a hotpatch is available. Additionally, it is recommended that GitLab instances should not be internet-facing, and if remote access is required, they should be placed behind a VPN (GitLab Blog).

The vulnerability gained significant attention after reports of active exploitation emerged. GitLab issued multiple advisories and blog posts urging users to update their installations. The severity was elevated when the vulnerability was reclassified as unauthenticated, leading to increased concern in the security community (Rapid7 Blog).