GHSA-q95h-cqrv-8jv5 ExifTool vulnerable to arbitrary code execution
Attackers can execute arbitrary code by tricking users into processing malicious image files with the ExifTool Ruby library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-q95h-cqrv-8jv5?
GHSA-q95h-cqrv-8jv5 is a code injection vulnerability in exiftool_vendored, published on 20 Jan 2023.
Official description
Impact
Arbitrary code execution can occur when running exiftool against files with hostile metadata payloads
Patches
ExifTool has already been patched in version 12.24. exiftool_vendored.rb, which vendors ExifTool, includes this patch in v12.25.0.
Workarounds
No
References
https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204
For more information
If you have any questions or comments about this advisory:
Open an issue in exiftool_vendored.rb
Which versions are affected by GHSA-q95h-cqrv-8jv5?
2 open source packages ship an affected version, including exiftool_vendored.
| Package | Affected | Fixed in |
|---|---|---|
exiftool_vendored RubyGems | All versions | 12.25.0 |
exiftool_vendored RubyGems | All versions | 12.25.0 |
How do I fix GHSA-q95h-cqrv-8jv5?
Upgrade exiftool_vendored to 12.25.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-q95h-cqrv-8jv5 being exploited?
There is no known exploitation of GHSA-q95h-cqrv-8jv5 in the wild and no public exploit code.