Eval() Injection in Fooocus Image Processing

Executive Summary

This is a Remote Code Execution (RCE) vulnerability in Fooocus 2.1.854 through 2.5.5 caused by an unsafe eval() call in the get_list function of modules/meta_parser.py. Attackers can exploit it by injecting malicious Python code into the EXIF metadata of an uploaded image, specifically in the styles payload. When the image is processed, the injected code executes, allowing arbitrary Python code to run on the victim's system.

Useful 0 Not Useful 0

Detection Guidance

Check Fooocus logs for suspicious EXIF metadata processing or unexpected Python code execution. Inspect uploaded images for malformed styles fields in EXIF data using tools like exiftool or strings command. Monitor network traffic for outbound connections from Fooocus processes.

Useful 0 Not Useful 0

Impact Analysis

If you use Fooocus locally, especially in a Docker environment on Linux, an attacker could execute arbitrary commands on your system by tricking you into uploading a malicious image. This could lead to full system compromise, data theft, or further network infiltration without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using Fooocus may face compliance breaches, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Fooocus if possible or restrict network access to the application. Avoid uploading untrusted images. Update to a patched version if available. Use a sandboxed environment to limit potential damage from code execution.

Useful 0 Not Useful 0