CVE-2013-4490

GitLab <5.4.1, <6.2.3 - Command Injection

Title source: llm

Description

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/34362
metasploit WORKING POC EXCELLENT
by Brandon Knight · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_shell_exec.rb

Scores

EPSS 0.4978
EPSS Percentile 97.8%

Details

Status published
Products (21)
gitlab/gitlab 5.0.0
gitlab/gitlab 5.0.1
gitlab/gitlab 5.1.0
gitlab/gitlab 5.2.0
gitlab/gitlab 5.3.0
gitlab/gitlab 5.4.0
gitlab/gitlab 6.0.0
gitlab/gitlab 6.1.0
gitlab/gitlab 6.2.0
gitlab/gitlab 6.2.1
... and 11 more
Published May 13, 2014
Tracked Since Feb 18, 2026