Friday, April 19, 2024

Critical RCE Vulnerability in Google’s VirusTotal Platform Let Attackers Scans Capabilities

There is a security vulnerability in the VirusTotal platform that has been discovered by researchers, and it has the potential to be exploited by an attacker to conduct RCE.

Shai Alfasi & Marlon Fabiano da Silva from the Cysource research team has stated:-

“They found a way to execute commands remotely within VirusTotal platform and gain access to its various scans capabilities.”

Technical Analysis

VirusTotal is a service that uses over 70 different third-party antivirus products to scan suspicious files and URLs for viruses. Here, through the platform’s web user interface, an attacker uploads a DjVu file to the platform in order to conduct the attack.

An exploit can be triggered with this in order to exploit a high-severity vulnerability in the ExifTool. Using ExifTool, one can read and edit EXIF metadata information in both scanned images and PDF files. ExifTool is an open-source utility.

When the ExifTool was executed, the attackers were planning on using the CVE-2021-22204, which would cause these scanners to run the payload as soon as the CVE-2021-22204 (CVSS score: 7.8) was triggered.

By exploiting this vulnerability an attacker can gain access to the following things with high-level privileges:-

  • Google-controlled environment.
  • Over 50 internal hosts.

On April 30, 2021, Cysource reported the bug to Google’s Vulnerability Reward Programs (VRP). However, the loophole was immediately fixed once the loophole was reported.

ExifTool has not only been targeted as a conduit for remote code execution in the past but it has also been used for other purposes.

A critical vulnerability “CVE-2021-22205,” with a CVSS score of 10 was fixed last year in GitLab. It is a flaw that is triggered by improper validation of user-provided images, leading to the execution of arbitrary code.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles