CVE-2013-4490 Command injection in n/a
Authenticated users can execute arbitrary commands on the server by injecting shell metacharacters into uploaded SSH public keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-4490?
CVE-2013-4490 is a medium-severity command injection vulnerability in Gitlab Gitlab, published on 13 May 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
Which versions are affected by CVE-2013-4490?
It affects 2 products.
Products include Gitlab Gitlab, Gitlab Gitlab-Shell.
How do I fix CVE-2013-4490?
No fix has been published for CVE-2013-4490 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-4490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-4490 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Gitlab Gitlab
- CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal
- CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control
- CVE-2021-22205 GitLab Community and Enterprise Editions Remote Code Execution
- CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF)
Sources
Also known as GHSA-9hhr-gwc7-jcvh.