Wednesday, April 30, 2025
HomeCVE/vulnerabilityCritical RCE Vulnerability in Google's VirusTotal Platform Let Attackers Scans Capabilities

Critical RCE Vulnerability in Google’s VirusTotal Platform Let Attackers Scans Capabilities

Published on

SIEM as a Service

Follow Us on Google News

There is a security vulnerability in the VirusTotal platform that has been discovered by researchers, and it has the potential to be exploited by an attacker to conduct RCE.

Shai Alfasi & Marlon Fabiano da Silva from the Cysource research team has stated:-

“They found a way to execute commands remotely within VirusTotal platform and gain access to its various scans capabilities.”

- Advertisement - Google News

Technical Analysis

VirusTotal is a service that uses over 70 different third-party antivirus products to scan suspicious files and URLs for viruses. Here, through the platform’s web user interface, an attacker uploads a DjVu file to the platform in order to conduct the attack.

An exploit can be triggered with this in order to exploit a high-severity vulnerability in the ExifTool. Using ExifTool, one can read and edit EXIF metadata information in both scanned images and PDF files. ExifTool is an open-source utility.

When the ExifTool was executed, the attackers were planning on using the CVE-2021-22204, which would cause these scanners to run the payload as soon as the CVE-2021-22204 (CVSS score: 7.8) was triggered.

By exploiting this vulnerability an attacker can gain access to the following things with high-level privileges:-

  • Google-controlled environment.
  • Over 50 internal hosts.

On April 30, 2021, Cysource reported the bug to Google’s Vulnerability Reward Programs (VRP). However, the loophole was immediately fixed once the loophole was reported.

ExifTool has not only been targeted as a conduit for remote code execution in the past but it has also been used for other purposes.

A critical vulnerability “CVE-2021-22205,” with a CVSS score of 10 was fixed last year in GitLab. It is a flaw that is triggered by improper validation of user-provided images, leading to the execution of arbitrary code.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...