GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
GitLab · Community and Enterprise Editions
Date added (CISA)
2021-11-03
Remediation due
2021-11-17
Known ransomware use
Yes
Remediation priority
P1 — known ransomware use · past CISA due date
Description
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.