A critical flaw in GitLab, fixed on April 14, 2021, remains exploitable, with over 50% of servers remaining unpatched.
See also: Python Package Index (PyPI) and GitLab under spam attacks
The vulnerability was designated as CVE-2021-22205 and has a CVSS v3 score of 10.0, allowing an unauthenticated, remote attacker to execute arbitrary commands as the “git” user (repository manager).
This vulnerability gives the remote attacker full access to the repository, including deleting, modifying, and stealing source code.
Hackers first began exploiting GitLab servers in June 2021 to create new users and give them administrator privileges .
Malicious actors used a functional exploit published on GitHub on June 4, 2021, which allows them to abuse the vulnerable ExifTool component.
Threat actors do not need to pass authentication or use a CSRF token or even a valid HTTP endpoint to exploit the vulnerability.
See also: Google Chrome: Gets HTTPS-Only Mode for Secure Browsing
With the vulnerability still persisting to this day, researchers from Rapid7 decided to examine the number of unpatched systems and determine the scope of the underlying problem.
According to a report published by Rapid7, at least 50% of the 60,000 internet-accessible GitLab installations they discovered have not been notified of the critical RCE flaw that was patched six months ago.
Additionally, another 29% may or may not be vulnerable, as analysts were unable to extract the version string for these servers.
Administrators should update to one of the following versions to fix the flaw:
13.10.3
13.9.6
13.8.8
Any versions prior to this and up to 11.9 are vulnerable to exploitation whether you are using GitLab Enterprise Edition (EE) or GitLab Community Edition (CE).
See also: GitLab: End to hiring staff from China and Russia due to espionage?
For more details on how to update GitLab, see this dedicated portal.
The patched versions still allow someone to contact ExifTool, but the response to the request should be a rejection in the form of an HTTP 404 error.
