Wednesday, May 28, 2025
HomeCVE/vulnerabilityUnauthenticated RCE Flaw in Gitlab Exploited Widely by Hackers

Unauthenticated RCE Flaw in Gitlab Exploited Widely by Hackers

Published on

SIEM as a Service

Follow Us on Google News

Cybersecurity researchers from Rapid7 have warned recently that a critical remote code execution (RCE) vulnerability has been found in the currently patched GitLab web interface. And this vulnerability is actively exploited in cyberattacks, making many Internet-connected GitLab instances vulnerable to attack. 

While this vulnerability has been tracked as CVE-2021-22205, and it is an unauthenticated remote code execution (RCE) vulnerability.

After investigating it thoroughly, it has been claimed that this issue is related to improper validation of user-supplied images that are commencing arbitrary code execution remotely. 

- Advertisement - Google News
  • CVE: CVE-2021-22205
  • Vendor Advisory: GitLab Advisory
  • IVM Content: Evaluating
  • Patching Urgency: ASAP
  • Last Update: November 1, 2021

Here we have mentioned all the patched versions below:-

  • 13.10.3
  • 13.9.6
  • 13.8.8

Exploit in the wild

When the threat actors first noted some glimpse of this attack that they have initially commenced exploiting internet-facing GitLab servers in June 2021, with the motive of creating new users and giving them all the admin rights.

Apart from this. in this exploit the threat actors don’t require to verify or use a CSRF token; not only this, but they also don’t require a valid HTTP endpoint to use the exploit.

Despite the availability of patches for more than six months, there is only 21% of the 60,000 internet-connected GitLab installations are fully patched for this particular issue.

However, the remaining 50% are still acknowledged to be vulnerable to RCE attacks. Therefore, the security experts have suggested each, and every user upgrades their GitLab to the most advanced version as soon as possible.

  • 21% of installs are fully patched against this issue.
  • 50% of installs are not patched against this issue.
  • 29% of installs may or may not be vulnerable.

Mitigation

However, Rapid7’s emergent threat response team has provided a full technical analysis of CVE-2021-22205. And they have strongly recommended all the GitLab users immediately update their vulnerable version to the latest version of GitLab.

Moreover, GitLab should not be used as a direct internet-facing service, in case if any users need to access their GitLab from the internet, they should consider placing it behind a VPN.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Use Fake DocuSign Notifications to Steal Corporate Data

DocuSign has emerged as a cornerstone for over 1.6 million customers worldwide, including 95%...

Government Calls on Organizations to Adopt SIEM and SOAR Solutions

In a landmark initiative, international cybersecurity agencies have released a comprehensive series of publications...

WordPress TI WooCommerce Wishlist Plugin Flaw Puts Over 100,000 Websites at Risk of Cyberattack

A severe security flaw has been identified in the TI WooCommerce Wishlist plugin, a...

Microsoft Alerts on Void Blizzard Hackers Targeting Telecommunications and IT Sectors

Microsoft Threat Intelligence Center (MSTIC) has issued a critical warning about a cluster of...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Severe WSO2 SOAP Flaw Allows Unauthorized Password Resets for Any Use

A newly disclosed vulnerability, CVE-2024-6914, has shocked the enterprise software community, affecting a wide...

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent...

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...