Researchers at depthfirst have published working exploit code for a critical GitLab vulnerability (CVE-2021-22236) that affects self-managed 18.11.3 servers. The vulnerability, which was disclosed on June 10, allows authenticated users to run commands as the GitLab user, with no authentication required. This means that any authenticated user who can push to a project on a self-managed server running version 18.11.3 can exploit the vulnerability. The vulnerability was patched six weeks later on July 10, but the exploit code was released before the patch was available.
The vulnerability is a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary commands on the server. The vulnerability is present in the GitLab self-managed application, and it affects versions 18.11.3 and later.
The researchers at depthfirst have published the exploit code on their website, along with detailed instructions on how to use it. The code is written in Python and uses the GitLab API to authenticate the attacker and execute commands on the server.
It's worth noting that the vulnerability is not present in GitLab.com hosted repositories, and it's also not present in GitLab Enterprise Edition.
Let me know if you need any adjustments. Here is the rewritten article: TITLE: GitLab RCE Exploit Code Released for Vulnerability Disclosed on June 10 SUMMARY: Security researchers at depthfirst have published working exploit code for a critical GitLab vulnerability (CVE-2021-22236) that affects self-managed 18.11.3 servers. Authenticated users can run commands as the GitLab user without additional authentication, putting servers at risk. CONTENT:Researchers at depthfirst have released exploit code for a critical GitLab vulnerability, exploiting a remote code execution (RCE) flaw in the self-managed 18.11.3 application. The vulnerability was publicly disclosed on June 10, allowing attackers to execute arbitrary commands on the server without authentication.
A self-managed GitLab server running version 18.11.3 is vulnerable to this RCE flaw, which can be exploited by any authenticated user who can push code to a project on the server.
The exploit code, published by depthfirst, is written in Python and uses the GitLab API to authenticate the attacker and execute commands on the server. Although the vulnerability was patched six weeks later on July 10, the exploit code was released before the patch was available.
It's worth noting that this vulnerability does not affect GitLab.com hosted repositories or GitLab Enterprise Edition.