What is EXIF Metadata?
EXIF stands for Exchangeable Image File Format. It is a record which shows the digital SLR camera settings used to take a particular photograph. This data is recorded into the actual image file. Therefore each photograph has its own unique data. EXIF data shows photo information such as camera model, exposure, aperture, ISO, what camera mode was used and whether or not a flash fired. The below image is an example of how EXIF Metadata looks like.
or,
What is EXIF Data Exposure?
EXIF Data stores sensitive information like Geo-location, Date, Name of the camera, Modified date, Time, Sensing Method, File Source, Type of compression etc. in the photos you click. Now this data resides in the every photo you take using cameras. Whenever you upload a picture on a website and if the website does not strip these sensitive data then this could lead to sensitive data exposure like the Geo-location, Date of the photo, Time of the photo, Camera used etc.
Exploiting EXIF Data Exposure
Exploiting EXIF Data Exposure is very simple. You just need to find an entry point where in you can upload an image. Such entry points can usually be in User Profile Image or Comments field which allows you to add files.
The steps to exploit this vulnerability are:
- Find an entry point for uploading an image
- Upload image containing sensitive EXIF meta data. You can find such images on https://github.com/ianare/exif-samples
- Once uploaded, either Copy Image Address or Save the Image
- Go to http://exif.regex.info/exif.cgi and paste the link or upload the image.
- Click on View Image Data and it will give you the EXIF metadata of that image (if the data is not stripped by the server).
Severity
The severity of EXIF Data Exposure depends on two cases
- Automatic User Enumeration P3 severity
- Automatic User Enumeration means the image you have uploaded is visible to public.
- Manual User Enumeration P4 severity
- Manual User Enumeration means the image you have uploaded is not visible to other users.
Impact of EXIF Data Exposure
This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads an image on the vulnerable website.
Prevention of EXIF Data Exposure
To prevent EXIF Data Exposure you can do the following:
- Disable geotagging on the digital device you use to take photographs.
- Use an image processing software or EXIF data remover tool to delete metadata.