Vulnerabilities

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.

CVE-2021-22204 is a code-injection flaw (CWE-95) in ExifTool, a widely used Perl library for reading and writing file metadata: versions 7.44 and later improperly neutralize user-supplied data when parsing the DjVu file format. It is triggered when ExifTool processes a crafted image or DjVu file, causing attacker-controlled input to be evaluated and executed in the context of the process doing the parsing. An attacker who can get a malicious file parsed, for example through a web service, media pipeline, or desktop application that extracts metadata from uploaded files, gains arbitrary code execution on the host. Any deployment running an affected ExifTool version that handles untrusted files is exposed, and because ExifTool is embedded inside many third-party products, affected systems may not have ExifTool visible in their inventory by name. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-17, EPSS assigns it a 100% probability of exploitation within 30 days (top percentile), and CISA's required action is to apply updates per vendor instructions.

Do: Upgrade ExifTool to version 12.38 or later wherever it is installed directly or bundled inside other software, and apply vendor-supplied patches for any third-party products that embed ExifTool. Prioritize systems that parse untrusted or user-uploaded images; as an interim mitigation, block or strip DjVu-formatted uploads and disable DjVu metadata extraction until patching is complete. Because the flaw is in CISA's KEV catalog with an active exploitation window, treat remediation as urgent and verify asset inventory for embedded copies of ExifTool.

ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).