Sunday, May 18, 2025
HomeCVE/vulnerabilityCritical RCE Vulnerability in Google's VirusTotal Platform Let Attackers Scans Capabilities

Critical RCE Vulnerability in Google’s VirusTotal Platform Let Attackers Scans Capabilities

Published on

SIEM as a Service

Follow Us on Google News

There is a security vulnerability in the VirusTotal platform that has been discovered by researchers, and it has the potential to be exploited by an attacker to conduct RCE.

Shai Alfasi & Marlon Fabiano da Silva from the Cysource research team has stated:-

“They found a way to execute commands remotely within VirusTotal platform and gain access to its various scans capabilities.”

- Advertisement - Google News

Technical Analysis

VirusTotal is a service that uses over 70 different third-party antivirus products to scan suspicious files and URLs for viruses. Here, through the platform’s web user interface, an attacker uploads a DjVu file to the platform in order to conduct the attack.

An exploit can be triggered with this in order to exploit a high-severity vulnerability in the ExifTool. Using ExifTool, one can read and edit EXIF metadata information in both scanned images and PDF files. ExifTool is an open-source utility.

When the ExifTool was executed, the attackers were planning on using the CVE-2021-22204, which would cause these scanners to run the payload as soon as the CVE-2021-22204 (CVSS score: 7.8) was triggered.

By exploiting this vulnerability an attacker can gain access to the following things with high-level privileges:-

  • Google-controlled environment.
  • Over 50 internal hosts.

On April 30, 2021, Cysource reported the bug to Google’s Vulnerability Reward Programs (VRP). However, the loophole was immediately fixed once the loophole was reported.

ExifTool has not only been targeted as a conduit for remote code execution in the past but it has also been used for other purposes.

A critical vulnerability “CVE-2021-22205,” with a CVSS score of 10 was fixed last year in GitLab. It is a flaw that is triggered by improper validation of user-provided images, leading to the execution of arbitrary code.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...

New Ransomware Attack Targets Elon Musk Supporters Using PowerShell to Deploy Payloads

A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...