Capgo EXIF Metadata Exposure Vulnerability in App Information Image Upload

A vulnerability exists in Capgo versions prior to 12.128.2, where the application fails to remove EXIF metadata from images uploaded through the app information endpoint. This oversight allows attackers to access sensitive geolocation data and other embedded metadata from the uploaded files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive geolocation information and other EXIF metadata from uploaded images.

Reproduction

To reproduce this vulnerability, upload an image containing EXIF metadata, including geolocation information, via the app information endpoint. After the image is uploaded, the EXIF metadata can be extracted and viewed, revealing the sensitive geolocation data that was not stripped from the image before upload.

Remediation

Users can update to Capgo version 12.128.2 or later, where this vulnerability has been addressed.