Executive Summary

The vulnerability exists in exiftool-vendored versions prior to 35.19.0, which provides Node.js access to ExifTool. In these affected versions, certain user-supplied strings were inserted into ExifTool command arguments without properly rejecting line delimiters such as newlines or carriage returns. This flaw allows an attacker to inject additional arguments into the ExifTool command by splitting a single intended argument into multiple ones. Additionally, unsafe control characters like NUL bytes were not rejected. This can lead to ExifTool reading or writing files that the attacker chooses, potentially accessing files accessible to the ExifTool process.

The vulnerability does not allow remote code execution, and it was fixed in version 35.19.0 by rejecting unsafe characters and preventing argument injection.

Useful 0 Not Useful 0

Impact Analysis

If an application uses a vulnerable version of exiftool-vendored and passes attacker-controlled strings to its APIs, an attacker could exploit this vulnerability to make ExifTool read arbitrary files accessible to its process or write output to files chosen by the attacker.

This could lead to unauthorized disclosure of sensitive information or modification of files within the permissions of the ExifTool process. However, no remote code execution has been demonstrated.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update exiftool-vendored to version 35.19.0 or later, where the issue is fixed.

Avoid passing attacker-controlled strings to the affected APIs that start ExifTool with the vulnerable argument interpolation.

Useful 0 Not Useful 0