ExifTool OS Command Injection Vulnerability in PNG File Parser on macOS

A command injection vulnerability has been identified in ExifTool versions up to 13.49 on macOS. The issue arises in the PNG file parser within the 'SetMacOSTags' function of 'lib/Image/ExifTool/MacOS.pm'. Manipulating the 'DateTimeOriginal' argument leads to unauthorized command execution on the operating system. This vulnerability can be exploited remotely and has been publicly disclosed, with an available exploit. The issue has been patched in version 13.50.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected system.

Reproduction

To reproduce this vulnerability, use ExifTool version 13.49 on macOS. Create a PNG file and embed a payload in the 'DateTimeOriginal' metadata tag. When the file is processed with ExifTool, the payload is executed, leading to command injection. The exploit can be automated with a script that uploads the crafted PNG file and triggers the command execution.

Remediation

Upgrade ExifTool to version 13.50 or later, where this vulnerability has been fixed.