# GitLab Pre-Auth RCE (CVE-2021-22205) Signature **URL:** \ **Category:** Rule Signatures\ **Created:** [February 10, 2023, 12:23am UTC](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308 "2023-02-10T00:23:57Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![cosmicgumbo](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@cosmicgumbo](https://community.emergingthreats.net/u/cosmicgumbo)\ **Post date:** [February 10, 2023, 12:23am UTC](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308/1 "2023-02-10T00:23:57Z")
As stated in the post, I don’t have a completed sig. I am not entirely sure how to sig on the injected code but I definitely think there is something here worth a sig. > **[Suricata/ET\_Open\_Submissions/2023/February/CVE-2021-22205\_20230209 at main ·...](https://github.com/eatinsundip/Suricata/tree/main/ET_Open_Submissions/2023/February/CVE-2021-22205_20230209)** > > main/ET\_Open\_Submissions/2023/February/CVE-2021-22205\_20230209 Let me know, thanks! ---
**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Post date:** [February 10, 2023, 11:44pm UTC](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308/2 "2023-02-10T23:44:14Z")
Thanks for the share! I’ll review this submission and provide some notes afterwards. ---
**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Post date:** [February 14, 2023, 8:57pm UTC](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308/3 "2023-02-14T20:57:21Z")
Hi cosmicgumbo, Thanks again for the submission that covers GitLab Pre-Auth RCE (CVE-2021-22205). The provided signature is almost done and just needs the http request body content, as you mentioned. From reviewing the provided CVE write ups, it appears that a solid signature should consider the following: - Content from a POST # Covered - Content from “/users/sign\_in” # Covered - Content with “X-CSRF-Token” # Covered - Content about parsing annotations from a DjVu file. The DjVu parising module used is from 2008. ([ExifTool CVE-2021-22204 - Arbitrary Code Execution | devcraft.io](https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html) \>\> [exiftool/lib/Image/ExifTool/DjVu.pm at 12.23 · exiftool/exiftool · GitHub](https://github.com/exiftool/exiftool/blob/12.23/lib/Image/ExifTool/DjVu.pm#L233)) . # Not Covered - Content containing “backslash followed by a newline” ([HackerOne](https://hackerone.com/reports/1154542)). # Not Covered # Covering DjVu specific content Here are the request bodies provided in your submission. Let’s understand the content before “(metadata”. Request Body Example #1 ```auto AT&TFORM...eDJVUINFO... ......,...BGjp....ANTa...?(metadata (Copyright "\ " . qx{touch /tmp/test} . \ " b ") ) ``` Request Body Example #2 ```auto AT&TFORM....DJVUANTa....(metadata. (Author "\.". return `date`; #") ``` If we review documentation on DjVu from [DjVu - Wikipedia](https://en.wikipedia.org/wiki/DjVu), we note that we should try finding for DjVu documetaion for Version 26 or atleast dated closer to 2008, [https://www.cuminas.jp/docs/techinfo/DjVu3Spec.pdf](https://www.cuminas.jp/docs/techinfo/DjVu3Spec.pdf). The docs help us understand what to expect from parsing DjVu files: - DjVu file header start with these 4-bytes (0x41 0x54 0x26 0x54) == AT&T - DjVu file structure itself consists of 4-bytes chunks. It is expected that there will be a magic number (AT&T), FORM, a FORM length, then a secondary identifier. In relation to the provided request bodies we see the following identifiers… - INFO, info on DjVu page - ANTa or ANTz, info on annotations - BGjp, JPEG encoded background OK, so what do we want to sig on? I would use… http.request\_body; content:“AT&TFORM”; offset:4; fast\_pattern; content:“DJV”; offset:4; content:“ANT”; This content targets DjVu file annotations. # Covering content backslash followed by a newline Let’s consider the content after (metadata. We know that if a backslash followed by a newline is in the metadata, the RCE exists. I would say this needs to appear twice to allow the injected content to properly be parsed. This Cyberchef recipe returns what “backslash followed by a newline” looks like in hex. > **[CyberChef](https://gchq.github.io/CyberChef/#recipe=To_Hex_Content('Only%20special%20chars%20including%20spaces',true)&input=XAo)** > > The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis OK, so what do we want to sig on? I would use… http.request\_body; content:“(metadata”; content:“|5c 0a|” distance:0; content:“|5c 0a|” distance:0; This content highlights the CVE. The final rule to be submitted will be… alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET EXPLOIT GitLab Pre-Auth RCE Detected (CVE-2021-22205)”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/uploads/user”; bsize:13; http.header\_names; content:“X-CSRF-Token”; http.request\_body; content:“AT&TFORM”; offset:4; fast\_pattern; content:“DJV”; offset:4; content:“ANT”; content:“(metadata”; content:“|5c 0a|”; distance:0; content:“|5c 0a|”; distance:0; reference:url,[devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html,url,hackerone.com/reports/1154542](http://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html,url,hackerone.com/reports/1154542); classtype:trojan-activity;) ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [February 18, 2023, 12:30am UTC](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308/4 "2023-02-18T00:30:53Z")
This rendered ET Open SID 2044201. Thanks @cosmicgumbo @bingohotdog !