CVE-2013-4490
GitLab <5.4.1, <6.2.3 - Command Injection
Title source: llmDescription
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/34362
metasploit
WORKING POC
EXCELLENT
by Brandon Knight · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_shell_exec.rb
Scores
EPSS
0.4978
EPSS Percentile
97.8%
Classification
Status
draft
Affected Products (21)
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab
gitlab/gitlab-shell
< 1.7.2
gitlab/gitlab-shell
gitlab/gitlab-shell
gitlab/gitlab-shell
... and 6 more
Timeline
Published
May 13, 2014
Tracked Since
Feb 18, 2026