Exiftool For Photo And Video
Monthly
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.