Information leakage in EXIF data of images in answerdev/answer


Reported on

Mar 29th 2023


EXIF stands for Exchangeable Image File Format and the EXIF data contains information such as the camera model and make, shutter speed, aperture, focal length, ISO number, date, time and much more. It can also store GPS coordinates of the location where an image was shot.

Proof of Concept

1.Upload any image in profile picture or comment 
2. Open picture and intercept request using burp suit.

3. Download exif metadata extension.

4. Check in repeater response Geolocation and many meta data showing.


This data breach is critical due to the following reasons:

An attacker can get the exact location where a particular photo was taken

A photo can be easily replicated by using the metadata of the image

The following image/picture shows an example of the data stored in the image metadata.

We are processing your report and will contact the answerdev/answer team within 24 hours. 2 months ago
We have contacted a member of the answerdev/answer team and are waiting to hear back 2 months ago
answerdev/answer maintainer validated this vulnerability a month ago

Nilabh Rajpoot has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
answerdev/answer maintainer marked this as fixed in 1.0.8 with commit ac3f2f a month ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
answerdev/answer maintainer published this vulnerability a month ago
to join this conversation