CVE-2021-22204
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 6.8epss 100%
de la publicación al arma18 días
Publicada en NVD23 abr
1ª PoC+18d
metasploit14 abr
CISA KEV+208d
probabilidad de explotación
100%top 1% de las CVE
explotación observada
síCISA + VulnCheck
34 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2021-12-01
Apply updates per vendor instructions.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Productos afectados
ExifTool · ExifToolPoCs públicas encontradas — 34
exploitdbwww.exploit-db.com/exploits/50911no verificadogithubgithub.com/convisolabs/CVE-2021-22204-exiftool★ 97githubgithub.com/UNICORDev/exploit-CVE-2021-22204★ 53githubgithub.com/AssassinUKG/CVE-2021-22204★ 27githubgithub.com/se162xg/CVE-2021-22204★ 12githubgithub.com/bilkoh/POC-CVE-2021-22204★ 8githubgithub.com/Akash7350/CVE-2021-22204★ 4githubgithub.com/trganda/CVE-2021-22204★ 3githubgithub.com/PenTestical/CVE-2021-22204★ 3githubgithub.com/ph-arm/CVE-2021-22204-Gitlab★ 2githubgithub.com/Asaad27/CVE-2021-22204-RSE★ 0githubgithub.com/battleofthebots/dejavu★ 0githubgithub.com/cc3305/CVE-2021-22204★ 0githubgithub.com/Roronoawjd/CVE-2021-22204★ 0githubgithub.com/d4ytox/CVE-2021-22204★ 0vulncheckvulncheck.com/xdb/c7544f312048no verificadocve_referencepacketstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.htmlno verificadocve_referencepacketstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlno verificadovulncheckvulncheck.com/xdb/11cab1d195edno verificadovulncheckvulncheck.com/xdb/793a0410f319no verificadovulncheckvulncheck.com/xdb/195f85ead56cno verificadovulncheckvulncheck.com/xdb/0e17974417e2no verificadovulncheckvulncheck.com/xdb/c7f016c6ff9cno verificadovulncheckvulncheck.com/xdb/c1144f28258fno verificadovulncheckvulncheck.com/xdb/0c2c0a7d6b52no verificadovulncheckvulncheck.com/xdb/228b3b833130no verificadovulncheckvulncheck.com/xdb/2e739ce176b6no verificadovulncheckvulncheck.com/xdb/c1c6e7d5d1dcno verificadovulncheckvulncheck.com/xdb/9c966b28d48ano verificadovulncheckvulncheck.com/xdb/72105893a08ano verificadocve_referencepacketstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/5ad37e033ef8no verificadovulncheckvulncheck.com/xdb/162401353b6bno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.htmlhttp://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlhttp://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.htmlhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.jsonhttps://hackerone.com/reports/1154542https://lists.debian.org/debian-lts-announce/2021/05/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204