Description

When the user uploads his profile picture, the uploaded image’s EXIF Geolocation Data does not get stripped. As a result, anyone can get sensitive information of Scoold users like their Geolocation, their Device information like Device Name, Version, Software & Software version used, etc.

Proof of Concept

1. Browse this link:- https://github.com/ianare/exif-samples/blob/master/jpg/gps/DSCN0010.jpg

2. Download the image & Upload the picture.

3. Now see the path of the uploaded image ( Either by right click on image then copy image address OR right-click, inspect the image, the URL will come in the inspect, edit it as HTML )

4. Then check the Exif Metadata of Image by CLI tool or any online tool.

5. Paste the URL () of the profile image path now you can see the EXIF data.

PoC

https://drive.google.com/file/d/1uo8f4blKTZ110GFch-4XPIRPVtLHb7PP/view?usp=sharing

Impact

This vulnerability impacts all users on Scoold. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads their profile picture on Scoold.