Arbitrary Code Execution in ExifTool-vendored
Summary
GHSA-4whq-r978-2x68: Arbitrary code execution in ExifTool. Affects exiftool-vendored versions < 14.3.0. Fixed in 14.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ExifTool-vendored is an npm package that vendors ExifTool, a powerful command-line tool used for reading, writing, and manipulating metadata in image, audio, and video files. It provides a convenient way to access ExifTool functionality within Node.js applications. However, a vulnerability has been discovered in ExifTool-vendored that allows for arbitrary code execution when processing files with malicious metadata payloads.
Vulnerability Detail
The vulnerability (CVE-2021-22204) arises from a lack of proper input validation in ExifTool-vendored. When the tool is used to process files containing hostile metadata, an attacker can exploit this flaw to execute arbitrary code. This can lead to various malicious activities, such as remote code execution, unauthorized access, and data manipulation. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
14.3.0
This is the first release that contains the fix.
npm install exiftool-vendored@14.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, ExifTool-vendored is vulnerable to arbitrary code execution when processing files with malicious metadata payloads. To mitigate this vulnerability, it is crucial to update to version 14.3.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exiftool-vendored →
FAQ
ExifTool-vendored is an npm package that vendors ExifTool, a command-line tool used for manipulating metadata in various file formats.
The vulnerability allows for arbitrary code execution, which can lead to remote code execution, unauthorized access, and data manipulation.
Update ExifTool-vendored to version 14.3.0 or later using the command 'npm install exiftool-vendored@latest'.
No, updating to the latest version is the only recommended solution.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2021-22204
References
Related vulnerabilities
Recent vulnerabilities recorded for exiftool-vendored.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
