ExifTool Remote Code Execution Vulnerability

概要

参考情報

• packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html · Exploit
• packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html · Exploit
• packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html · Exploit
• packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html · Exploit
• openwall.com/lists/oss-security/2021/05/09/1 · Mailing List
• openwall.com/lists/oss-security/2021/05/10/5 · Mailing List
• exiftool/exiftool commit cf0f4e7 · Patch
• gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json · Third Party Advisory
• hackerone.com/reports/1154542 · Exploit

exiftool のその他の脆弱性

• CVE-2026-3102高 8.8A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool…
• CVE-2022-23935高 7.8lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
• CVE-2018-20211高 7.8ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username,…