CVE-2021-22204

ExifTool Remote Code Execution

6.8 MEDIUMActively exploited (CISA KEV)Public exploitEPSS 100.0%

Published23 Apr 2021
Added to CISA KEV17 Nov 2021
Remediation due1 Dec 2021

Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityLow

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected products

Exiftool≥ 7.44 < 12.24

Debian Linux10.0 · 9.0

Fedoraproject Fedora32 · 33 · 34

Remediation

Fixed in

Exiftool≥ 12.24

Patch & vendor advisories

https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800

References

http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800Patch
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.jsonThird Party Advisory
https://hackerone.com/reports/1154542ExploitIssue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00018.htmlMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/Release Notes

and 5 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-22204 being actively exploited?

Yes. CVE-2021-22204 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 17 Nov 2021.

How severe is CVE-2021-22204?

CVE-2021-22204 has a CVSS 3.1 base score of 6.8, rated medium. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2021-22204?

Affected products include Exiftool, Debian Linux, Fedoraproject Fedora.

How do I fix CVE-2021-22204?

Upgrade affected software to a fixed version, for example Exiftool 12.24 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-22204 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.