GitLab ExifTool DjVu RCE

aka ExifTool CVE-2021-22204 in GitLab

Product: GitLab GitLab CE/EE
CVE: CVE-2021-22205
Disclosed: 2021-04-14
CVSS: 10
Auth: pre-auth
CISA KEV: yes
Affected: 11.9 - 13.8.7, 13.9.0 - 13.9.5, 13.10.0 - 13.10.2
Fixed: 13.8.8, 13.9.6, 13.10.3

Summary

GitLab passed uploaded images to ExifTool to strip metadata, and ExifTool's DjVu parser evaluated part of the file as Perl. An unauthenticated upload endpoint meant any internet-facing GitLab could be compromised with a crafted 'image'; botnets abused it months later after its severity was raised to 10.0.

Root cause

ExifTool (CVE-2021-22204) parsed DjVu ANTa annotation chunks using a Perl eval with incomplete escaping, so a metadata string like (Copyright "\ " . qx{cmd} . \ " b ") executes commands. GitLab Workhorse invoked ExifTool on files uploaded to endpoints such as /uploads/user that were reachable without authentication, regardless of file extension.

Impact

Unauthenticated RCE as the git user on GitLab servers.

Public PoC

# DjVu file (AT&TFORM ... DJVUINFO ... ANTa) whose annotation chunk contains:
(metadata
	(Copyright "\
" . qx{touch /tmp/success} . \
" b ") )

# uploaded as test.jpg (image/jpeg) to POST /uploads/user with any CSRF token from /users/sign_in

Source: vulhub / gitlab/CVE-2021-22205 (poc.py)

Detection

Look for POSTs to /uploads/user (and other upload endpoints) with image MIME types but DjVu (AT&TFORM) magic bytes. nuclei template CVE-2021-22205.

Mitigation

Upgrade GitLab to a fixed version (bundles ExifTool 12.24+).