CVE-2021-22204
ExifTool Remote Code Execution Vulnerability
Description
CVE-2021-22204 is a code injection vulnerability in ExifTool, the widely used Perl-based metadata extraction tool. Improper neutralization of user data in the DjVu file format parser in ExifTool versions 7.44 through 12.23 allows attackers to achieve arbitrary code execution by supplying a malicious image file. This code injection vulnerability in ExifTool is particularly dangerous because ExifTool is commonly integrated into web applications and CI/CD pipelines for automated image processing. CISA has confirmed active exploitation of CVE-2021-22204, and an EPSS score of 92.76% (99.8th percentile) indicates near-certain exploitation, notably because the vulnerability was chained with GitLab to achieve unauthenticated remote code execution.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exiftool project | exiftool | >= 7.44, < 12.24 |
| debian | debian linux | 9.0; 10.0 |
| fedoraproject | fedora | 32; 33; 34 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/05/09/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/05/10/5(Mailing List, Third Party Advisory)
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800(Patch)
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json(Third Party Advisory)
- https://hackerone.com/reports/1154542(Exploit, Issue Tracking, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/(Release Notes)
- https://www.debian.org/security/2021/dsa-4910(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
In CVE-2021-22204, ExifTool's DjVu file format parser improperly neutralizes user-controlled data before evaluating it as Perl code. When processing a crafted DjVu ANT annotation, the parser passes attacker-controlled input to Perl's code evaluation mechanism, enabling arbitrary code execution within the ExifTool process context.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2021-22204 has a CVSS 3.1 score of 6.8 (MEDIUM) based on the secondary assessment, though NVD assigns a higher score of 7.8 (HIGH) with the primary vector. The vulnerability requires local access but no privileges and no user interaction, with a changed scope indicating it can affect resources beyond ExifTool itself. While the individual CVSS sub-metrics show low impact on confidentiality, integrity, and availability, the real-world impact is significantly amplified by ExifTool's widespread integration into web applications. Most notably, this vulnerability was chained with GitLab to achieve unauthenticated remote code execution against GitLab instances, vastly expanding the attack surface beyond local exploitation. With an EPSS score of 92.76% (99.8th percentile), CVE-2021-22204 is near-certain to be exploited, and its use in the GitLab attack chain demonstrates the severe real-world consequences of this seemingly moderate-severity vulnerability.
Exploit Maturity
CVE-2021-22204 has extensive public exploit availability and is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available through multiple sources, including the original ExifTool DjVu ANT Perl Injection proof-of-concept, a GitLab Unauthenticated Remote ExifTool Command Injection exploit, a GitLab 13.10.2 Remote Code Execution exploit, and an ExifTool 12.23 Arbitrary Code Execution exploit. The EPSS score of 92.76% (99.8th percentile) reflects near-certain exploitation activity. The vulnerability was notably chained with GitLab's image upload functionality to achieve unauthenticated remote code execution on GitLab servers, as documented in a HackerOne report.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: update ExifTool to version 12.24 or later, which addresses the DjVu file format code injection vulnerability.
- Verify all instances of ExifTool (versions 7.44 through 12.23) have been updated, including those bundled within web applications, CI/CD pipelines, and container images. Check systems running Debian Linux 9.0 and 10.0, and Fedora 32, 33, and 34 for distribution-packaged versions.
- If immediate patching is not possible, disable DjVu file processing in ExifTool or implement strict file type validation to reject DjVu files before they reach ExifTool. Restrict which file formats ExifTool processes using the
-extflag. - Audit systems that integrate ExifTool for image processing, particularly web applications like GitLab that automatically process uploaded images. Review logs for suspicious DjVu file uploads or unexpected process execution originating from ExifTool.
- Implement defense-in-depth by running ExifTool processes with minimal privileges, in sandboxed environments (containers, seccomp profiles), and with restricted network access to limit the impact of code execution vulnerabilities.
Technical Details
CVE-2021-22204 exploits a code injection flaw in ExifTool's DjVu file format parser, specifically in the handling of ANT (annotation) chunks within DjVu files. When ExifTool parses a crafted DjVu file, attacker-controlled data from the ANT annotation is improperly passed to Perl's code evaluation mechanism without adequate sanitization, allowing arbitrary Perl code execution. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) indicates local access is required, but the changed scope means the impact extends beyond ExifTool itself. In practice, the local access requirement is bypassed when ExifTool is integrated into web applications — the GitLab exploitation chain demonstrated this by uploading a malicious DjVu image through the web interface, which GitLab's backend automatically processed with ExifTool, converting a local code injection into unauthenticated remote code execution.
Frequently Asked Questions
Is CVE-2021-22204 being actively exploited?
Yes. CVE-2021-22204 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Multiple public exploits are available, including chains targeting GitLab instances. The EPSS score of 92.76% (99.8th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-22204?
CVE-2021-22204 directly affects ExifTool versions 7.44 through 12.23. It also impacts any application that integrates ExifTool for image processing, most notably GitLab, which was targeted through this vulnerability. Affected distributions include Debian Linux 9.0 and 10.0, and Fedora 32, 33, and 34.
How do I fix CVE-2021-22204?
Update ExifTool to version 12.24 or later. Ensure all bundled or distribution-packaged instances are also updated. As interim measures, disable DjVu file processing or run ExifTool in a sandboxed environment with minimal privileges.
How severe is CVE-2021-22204?
CVE-2021-22204 has a CVSS 3.1 score of 6.8 (MEDIUM) to 7.8 (HIGH) depending on the assessment. While the base score appears moderate, the real-world severity is significantly higher due to widespread ExifTool integration in web applications and the availability of exploitation chains that achieve unauthenticated remote code execution on platforms like GitLab.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.