PT-2022-16352 · Exiftool+3 · Exiftool+3

Published 2021-05-27 · Updated 2024-09-10 · CVE-2022-23935

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ExifTool versions prior to 12.38

Description The issue arises from the mishandling of a $file =~ /|$/ check in lib/Image/ExifTool.pm, leading to command injection.

Recommendations For versions prior to 12.38, update to version 12.38 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2021-1867

ALT-PU-2022-2010

ALT-PU-2022-2517

ALT-PU-2024-12214

CVE-2022-23935

MGASA-2022-0381

OPENSUSE-SU-2024:11794-1

Affected Products

Alt Linux

Astra Linux

Debian

Exiftool

References · 20

• 🔥 https://github.com/BKreisel/CVE-2022-23935 · Exploit
• 🔥 https://github.com/cowsecurity/CVE-2022-23935 · Exploit
• 🔥 https://github.com/0xFTW/CVE-2022-23935 · Exploit
• 🔥 https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429 · Exploit
• https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23935 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0381 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23935 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23935 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23935 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11794-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23935 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23935 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0381.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/BKMOJHTMTSAYV7B2A27CBMM7IBAZIRWE · Vendor Advisory