GitLab has warned users about an increase in malicious activity related to the exploitation of the critical vulnerability CVE-2021-22205, which allows remote code execution on the server running the GitLab collaborative development platform without authentication.
The issue has been present in GitLab since version 11.9 and was fixed back in April in releases GitLab 13.10.3, 13.9.6, and 13.8.8. However, according to a scan conducted on October 31 of 60,000 publicly available GitLab instances, 50% of systems are still using outdated versions of GitLab that are vulnerable. Necessary updates have only been installed on 21% of the checked systems. servers, while the version used could not be determined for 29% of the systems.
Neglect by GitLab server administrators regarding updates has led to the vulnerability being actively exploited by attackers, who have begun deploying malware and connecting them to a botnet involved in DDoS attacks. servers At its peak, the traffic during the DDoS attack generated by the botnet based on vulnerable GitLab servers reached up to 1 terabit per second.
The vulnerability is caused by improper handling of uploaded image files by an external parser based on the ExifTool library. The vulnerability in ExifTool (CVE-2021-22204) allowed arbitrary commands to be executed in the system when parsing metadata from DjVu files: (metadata (Copyright «\ » . qx{echo test >\/tmp\/test} . \ » b «) )
Moreover, since the actual format was determined in ExifTool by the content's MIME type rather than the file extension, an attacker could upload a DjVu document with an exploit disguised as a regular JPG or TIFF image (GitLab calls ExifTool for all files with jpg, jpeg, and tiff extensions to clean excess tags). Example of the exploit. In the default configuration of GitLab CE, the attack can be carried out by sending two requests that do not require authentication.
GitLab users are advised to ensure they are using the latest version, and if using an outdated release, to urgently install updates. If this is not possible for any reason, selectively apply a patch to block the vulnerability. Users of outdated systems are also encouraged to ascertain that their system has not been compromised by analyzing logs and checking for suspicious attacker accounts (such as dexbcx, dexbcx818, dexbcxh, dexbcxi, and dexbcxa99).
Source: opennet.ru
