CVE-2013-4490

GitLab <5.4.1, <6.2.3 - Command Injection

Title source: llm

Description

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/34362
metasploit WORKING POC EXCELLENT
by Brandon Knight · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_shell_exec.rb

Scores

EPSS 0.4978
EPSS Percentile 97.8%

Classification

Status draft

Affected Products (21)

gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab-shell < 1.7.2
gitlab/gitlab-shell
gitlab/gitlab-shell
gitlab/gitlab-shell
... and 6 more

Timeline

Published May 13, 2014
Tracked Since Feb 18, 2026