Information leakage in EXIF data of images in answerdev/answer
Mar 29th 2023
EXIF stands for Exchangeable Image File Format and the EXIF data contains information such as the camera model and make, shutter speed, aperture, focal length, ISO number, date, time and much more. It can also store GPS coordinates of the location where an image was shot.
Proof of Concept
1.Upload any image in profile picture or comment 2. Open picture and intercept request using burp suit. 3. Download exif metadata extension. 4. Check in repeater response Geolocation and many meta data showing.
This data breach is critical due to the following reasons:
An attacker can get the exact location where a particular photo was taken
A photo can be easily replicated by using the metadata of the image
The following image/picture shows an example of the data stored in the image metadata.
We are processing your report and will contact the answerdev/answer team within 24 hours. 2 months ago
A answerdev/answer maintainer validated this vulnerability a month ago
Nilabh Rajpoot has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
A answerdev/answer maintainer marked this as fixed in 1.0.8 with commit ac3f2f a month ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
to join this conversation