GitLab CE/EE CVE-2021-22205 (remote command execution through image file parsing / ExifTool, CISA KEV): which GitLab versions are vulnerable, how do I patch an old self-managed instance and check it for compromise?

What it is: CVE-2021-22205 is a remote command execution flaw in self-managed GitLab Community and Enterprise Edition. GitLab passed uploaded image files to a file parser (ExifTool) without properly validating them, so a crafted image could run commands on the server as the GitLab user. It was fixed in April 2021, but many instances weren't updated; it was then exploited at scale in late 2021 (including to build botnets and add rogue admin users), and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Old internet-facing GitLab servers are still found with it. Am I affected: - GitLab CE/EE from 11.9 up to 13.8.7, 13.9.0 to 13.9.5, and 13.10.0 to 13.10.2 (fixed in 13.8.8, 13.9.6 and 13.10.3). - Check: the Help page (/help) when signed in shows the version, or on the server run sudo gitlab-rake gitlab:env:info (Omnibus). - GitLab.com was patched by GitLab; this is about self-managed instances. Fix: 1. Upgrade to a currently supported GitLab release, following GitLab's upgrade path (major versions must be stepped through in order; use the official upgrade path tool). A version that old is missing years of other security fixes too. 2. If you can't upgrade immediately, take the instance off the internet (VPN or allow-list only) until you can. 3. Check for compromise on any instance that ran a vulnerable version while exposed: review the admin area for unknown administrator accounts and recently created users, look for unexpected processes, cron jobs or SSH keys under the git user, high CPU from miners, and unexpected outbound connections. If anything is found, rebuild on a clean server and restore data from a trusted backup. 4. Rotate secrets the server held: personal and project access tokens, deploy keys, CI/CD variables and runner registration tokens, and integration credentials. Verify: /help shows a supported patched version, no unknown admins or keys remain, and your scanner no longer flags CVE-2021-22205. Sources: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/ https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205