Executive brief
ExifTool is a widely-used utility for reading and writing image metadata across multiple file formats. A vulnerability in how it parses hostile metadata payloads allows an attacker with local access to execute arbitrary code when the tool processes a specially crafted image file. This could enable account compromise, data theft, or lateral movement within a system.
Technical details
This vulnerability is classified as improper neutralization of input during an OS command (CWE-74), allowing arbitrary code execution through crafted metadata payloads. The root cause is insufficient sanitization of metadata content before passing it to system commands. Attack requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). An attacker can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected system. ExifTool patched this in version 12.24, and the npm-vendored wrapper exiftool-vendored includes the fix in version 14.3.0. No workarounds are available; users must upgrade.
Affected products
- ExifTool ExifTool < 12.24
- photostructure exiftool-vendored < 14.3.0
Timeline
- 2021-05-04: disclosed: Advisory GHSA-4whq-r978-2x68 published
- 2021-05-04: patched: ExifTool version 12.24 includes patch; exiftool-vendored version 14.3.0 includes the fix