On April 30, 2021, Cysource reported the bug to Google’s Vulnerability Reward Programs (VRP). When the ExifTool was executed, the attackers were planning on using the CVE-2021-22204, which would cause these scanners to run the payload as soon as the CVE-2021-22204 (CVSS score: 7.8) was triggered.īy exploiting this vulnerability an attacker can gain access to the following things with high-level privileges:. Using ExifTool, one can read and edit EXIF metadata information in both scanned images and PDF files. Here, through the platform’s web user interface, an attacker uploads a DjVu file to the platform in order to conduct the attack.Īn exploit can be triggered with this in order to exploit a high-severity vulnerability in the ExifTool. *cpe:2.3:o:debian:debian_linux:10.VirusTotal is a service that uses over 70 different third-party antivirus products to scan suspicious files and URLs for viruses. Reference No Types Mailing List, Third Party Advisory Exploit, Third Party Advisory, VDB Entry Mailing List Third Party List Third Party List Third Party List Third Party Advisory Permissions Required Third Party Advisory

Please address comments about this page to Party Advisory VDB Entry

Further, NIST does notĮndorse any commercial products that may be mentioned on Not necessarily endorse the views expressed, or concur with Sites that are more appropriate for your purpose.

Inferences should be drawn on account of other sites being May have information that would be of interest to you. We have provided these links to other web sites because they References to Advisories, Solutions, and Toolsīy selecting these links, you will be leaving NIST webspace.

Exiftool exploit