Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities
########################################################################
Summary :
A large majority of PHP Images Gallery Technologies now handle the
Exchangeable Image File (EXIF) header of jpeg files. The Exchangeable
Image File (EXIF) format is an international specification that lets
imaging companies encode metadata information into the headers or
application segments of a JPEG file. Unfortunately the metadata gathered
in the EXIF header are not well sanitized when displayed.
########################################################################
Details :
Displaying the EXIF information is a nice feature, and more and more
online gallery try to enable this functionnality to please their users.
The default behavior of all these technologies is not always the same,
in some cases you may have to configure the gallery to display the EXIF
info or install an additionnal tool (jhead for example) to enable the
functionnality.
When, the setup process is done, the EXIF info will be displayed
automatically when clicking on the picture (in rare cases you may have
to request the EXIF info by clicking on an information/exif button).
When displayed, the EXIF information is not sanitized, which makes the
gallery technology vulnerable to cross site scripting attacks.
Vulnerable Systems:
* Coppermine (up to 1.3.3, >= beta 1.4.1 not vulnerable)
==>http://coppermine.sourceforge.net/
* Gallery 1.5.1-RC2 and prior
(in addition the photo description field was vulnerable to XSS)
==>http://gallery.menalto.com/
* phpGraphy (up to version 0.9.9a, >= 0.9.10 not vulnerable)
==>http://phpgraphy.sourceforge.net/
* YaPig 0.95 and prior
==>http://yapig.sourceforge.net/
A large number of galleries are available, if you want to extend the
test panel, try for example :
http://directory.google.com/Top/Computers/Programming/Languages/PHP/Scripts/Image_Galleries/
Commercial technologies are vulnerable too
* PhotoPost PHP Pro (current version)
==> http://www.photopost.com/
After a short survey, it looks like online images galleries as MSN,
YAHOO, ShutterFly, Pixagogo, PictureTrail ... don't provide EXIF
metadata for now. So are not affected by this vulnerability.
Release Date :
August 26, 2005
Severity :
MEDIUM
########################################################################
Example :
Take your favorite picture, and save it in .jpg. Use the EXIF editor of
your choice and edit the Camera Model Tag. Replace the current value by
" <script>alert(document.cookie)</script> ".
Then upload the jpeg file to your favorite Online Gallery and click on
the picture ... XSS.
########################################################################
Vendor Status :
The information has been provided to all concerned Project Managers the
17th of August 2005.
* Coppermine
Update to Coppermine pg1.3.4
http://coppermine-gallery.net/forum/index.php?topic=20933.0
* Gallery
Update to the final release of Gallery 1.5.1.
http://gallery.menalto.com/modules.php?op=modload&name=phpWiki&file=index&pagename=Download
A patch for Gallery 1.5 and a new Debian's Gallery 1.2.5 package have
been released too.
* phpGraphy
Update to version 0.9.10
http://phpgraphy.sourceforge.net/download.php
* YaPig
No answer up to now.
* PhotoPost PHP Pro
On the 22nd of August:
"we'll be issuing an update to PhotoPost today which will sanitize this
data before being displayed"
########################################################################
Credit :
Cedric Cochin, Network Security Expert
Web Site: http://cedri.cc
< cedric.cochin [-at-] gmail .DoT. com >
Currently => SecureScout Product Integration Manager
Previously => netVigilance SecurityWatch Team Manager
Web Site => http://www.securescout.com || http://www.netvigilance.com
Original Advisory link:
http://cedri.cc/advisories/EXIF_XSS.txt
