30,000 GitLab Servers Remain Unpatched Against Critical Bug

Share post:

A critical, unauthenticated, remote code execution GitLab bug remains exploitable, with over 50% of deployments remaining unpatched after it was fixed on April 14, 2021.

The vulnerability tracked as CVE-2021-22205 with a CVSS v3 score of 10.0, allows an unauthenticated, remote attacker to execute arbitrary commands as a “git’ user. This vulnerability allows the attacker to gain full access to the repository, including deleting, modifying, and stealing source code.

Hackers first exploited internet-facing GitLab servers in June 2021 to create new users and grant them admin privileges, and then exploited a working exploit released on GitHub on June 4, 2021, to abuse the vulnerable ExifTool component.

Attackers do not need to resort to authentication or the use of a CSRF token or even a valid HTTP endpoint to exploit.

Since the exploitation continues to this day, the researchers at Rapid7 decided to draw attention to the number of unpatched systems in order to determine the extent of the underlying problem.

In a report published by Rapid7, at least 50% of the 60,000 internet-facing GitLab installations they found were not patched against the critical RCE vulnerability that had been fixed six months earlier.

In addition, another 29% may or may not be vulnerable, with analysts failing to extract the version string for those servers.

Administrators need to upgrade to one of the following versions to fix the bug:

  • 13.10.3
  • 13.9.6
  • 13.8.8

To keep GitLab instances safe from exploitation, users should check its response to POST requests that aim to exploit the incorrect handling of image files by ExifTool. The patched versions still allow someone to contact ExifTool, but the response to the request should be a rejection via an HTTP 404 error.

For more information, read the original story in BleepingComputer.

SUBSCRIBE NOW

Related articles

Cyber Security Today, Week in Review for week ending Friday May 17, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, May 17th,...

Cyber Security Today, May 17, 2024 – Malware hiding in Apache Tomcat servers

Malware hiding in Apache Tomcat servers, new backdoors found, and more Welcome to Cyber Security Today. It's Friday, May...

MIT students exploit blockchain vulnerability to steal 25 million dollars

Two MIT students have been implicated in a highly sophisticated cryptocurrency heist, where they reportedly exploited a vulnerability...

Cyber Security Today, May 15, 2024 – Ebury botnet still exploits Linux servers, Microsoft, SAP and Apple issue security updates

The Ebury botnet continues to exploit Linux servers, Microsoft, SAP and Apple issue security updates, and more. Welcome to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways