CVE-2021-22204

Perl Exiftool: Remote Code Execution

As of , CVE-2021-22204 in Perl Exiftool is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 17 November 2021
US federal deadline
1 December 202114 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
2 Metasploit modules and 1 Exploit-DB entry
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CISA's description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

The CVE record's description, from GitLab

CVE published
23 April 2021
Assigned by
GitLab
CVSS
6.8 Medium (CVSS 3.1, from the CNA)
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
partial

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. Exploit-DB published an exploit (EDB-ID 50911).

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: GitLab Unauthenticated Remote ExifTool Command Injectionexploit module, rank excellent
  • Metasploit: ExifTool DjVu ANT Perl injectionexploit module, rank excellent
  • Exploit-DB: ExifTool 12.23 - Arbitrary Code ExecutionEDB-ID 50911, 11 May 2022

Read further