3

My organization uses a plugin to import metadata associated with images on web pages. Are there any risks associated with importing metadata?

2 Answers 2

3

Absolutely. For example, it is a fairly well-known trick to embed XSS attacks in JPEG EXIF data. Here's some very simple example code that's exploitable with a corresponding image: https://github.com/vjex/Exif-XSS

2
1

Metadata is just like any other user input. You should assume that the user has complete control over the metadata, so you should not trust it in any way.

The possible risks are also the same as with any user input: XSS (in case you display the metadata), SQL injection (in case you save the metadata to the database), code execution (in case you pass the metadata to functions allowing for code execution), and so on.

Of course, not only the functions handling the metadata need to be secure, but also the function which extracts the data.

Not trusting the metadata also means that you cannot rely on it for your application logic. For example, if the metadata says that the image was created by Foobar on 2015:10:10, that doesn't mean that that is necessarily true.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .