1

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be possible to calculate its CVSS score?

I definitely think it's a vulnerability, impacting confidentiality (considering the CIA triad). But the issue seems to be a bit controversial, because some say it's the user's fault for uploading the image containing the data, so it's not a vulnerability but a feature, while others like me say that since the user definitely does not want to ever upload that data in public or expect to be visible in public, without explicit consent, it must be a vulnerability. Social media like Facebook and Twitter remove the metadata, while other software powering smaller online communities might not.

Improve this question
9
  • 2
    How is it something that is in scope of CVSS? Also, what makes it a vulnerability of the site? I think that you are mis-using the terms.
    – schroeder ♦
    Commented Nov 2, 2023 at 23:20
  • 1
    Keeping the meta information (creator, dates, GPS, type of camera, ...) inside can actually be a feature. It very much depends on what the site is for, the threat model and the expectations of the users. If the goal is to protect the privacy of the users than failure to remove or degrade the meta information (like limiting granularity) might be considered a vulnerability. If the goal is to share images in all their detail then keeping these information then it is more a feature and not a vulnerability.
    – Steffen Ullrich
    Commented Nov 2, 2023 at 23:50
  • 1
    @schroeder, how can it not be a vulnerability if there is a data breach? The user does not expect, for example, a picture of their cat to leak their home address. Where is the bug leading to the leak? In the phone camera? No, that's a feature, because the metadata isn't leaving the phone. Somewhere in the upload process? Yes, because it's when you transfer the picture that the leak is going to happen. The web application should then remove the metadata by default, and maybe have an option where the user can enable metadata in pictures (I guess Flicker has such an option).
    – reed
    Commented Nov 3, 2023 at 11:07
  • 1
    @SteffenUllrich, yes, but since the developers of the web app might not know its exact use (it might be used in a community for professional photographers, or a community for controversial political issues), and the users themselves never see a warning in the upload process, then I believe the default behavior should be to remove the metadata anyway.
    – reed
    Commented Nov 3, 2023 at 11:14
  • @reed: "since the developers of the web app might not know its exact use" - in an ideal world applications should have a purpose and developers (or at least product owners) should be aware of the purpose and design the application appropriately. Similar customers should choose applications based on their actual requirements - which means that they must have these requirements in the first place. The same as one might blame the users or developers one might blame the ones which chose a specific application without making sure that the application fits the intended purpose.
    – Steffen Ullrich
    Commented Nov 3, 2023 at 11:40

4 Answers 4

Reset to default
3

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not?

It's not a vulnerability. It can be a privacy issue, but not a security vulnerability. It's something the user can control: if they don't want EXIF tags on their pictures, they can disable them on the camera settings of their phone.

It's like not taking pictures of your face, or your house with your car parked showing the license plate and general location. It's something entirely in control of the user. The social network may help by deleting EXIF tags or blurring faces and licence plates, but not doing so is not a vulnerability.

I definitely think it's a vulnerability, impacting confidentiality

It's not. Confidentiality means something that should not be disclosed got disclosed because of a flaw on the system. EXIF tags are part of the file, they are not encrypted and are not hidden. They are like the tags on a MP3 file.

Improve this answer
3
  • I don't buy this argument for the following reason: the "consent" is given at different times and for different purposes. When you take a picture on your phone, you might be ok with embedding the GPS data in the original pictures. But when you upload it somewhere, you usually are not ok with that anymore. And when you upload a picture, everybody is obviously going to be aware that they are uploading their face or license plate, but they are not likely to be aware that they are also uploading GPS data.
    – reed
    Commented Nov 3, 2023 at 14:41
  • 1
    Geotagging is a feature you can control. It's not something leaking because of faulty controls or undefined/unintended behavior of some application or system component. It's well defined, works as designed, can be controlled by the user and there's a graphical interface to set it on or off.
    – ThoriumBR
    Commented Nov 3, 2023 at 14:49
  • 1
    The user can control and choose their own passwords too, but decent systems don't accept passwords that are like 3 chars long. If a web app accepts passwords that are 3 chars long, is it a vulnerability? I think this could be a good analogy. If you find it ridiculous (and I do) that a web app accepts 3-char long passwords, then for the same reason you should find it ridiculous that a web app doesn't strip GPS data from pics.
    – reed
    Commented Nov 3, 2023 at 15:01
3

I think the concept you are looking for is "Hazard" not "Vulnerability".

Vulnerabilities are Hazards, but Hazards encompass far more than Vulnerabilities.

Let's take a look at this situation in context:

  1. the photo system successfully performed its function to create the file with the required metadata.
  • There is no error, no misuse or abuse, or security issue at this point.
  1. The user copied the file to the web application.
  • There is no error, no misuse or abuse, or security issue at this point.
  1. The web application processes the file and the metadata securely.
  • There is no error, no misuse or abuse, or security issue at this point.

The potential issue in this situation is that the metadata could contain sensitive info that, if accessed legitimately by an authorised user of the web application, could result in harm to the user who used the photo system in step 1.

At no point has anything "gone wrong". Everything has operated in a safe state. Yet, despite all these systems and processes operating in a safe state, the conditions for a Hazard have emerged. So, there is no "Vulnerability", but a "Hazard".

Why did it emerge?

  • The metadata placed on the file is not obvious to the user
  • The user can upload the file without notice about the potential hazard
  • The web application does not provide notice of the metadata or proactively remove it

None of this is a vulnerability. Nothing has "gone wrong". There is an inherent weakness in the nature of the metadata. So, from a Human Factors perspective, the Pre-condition for the Hazard is that the potentially sensitive metadata is not made obvious to the user at any point. So, that's a weakness of the file and its metadata, and not of the systems that process it or a weakness of the user.

So, who is responsible for mitigating that Hazard?

Potentially, no one. Yes, some web applications proactively remove the metadata, but for some web applications, this could not necessarily be because the web application wants to reduce Hazards, but could simply be a side-effect of the web app reconstructing the photo for efficiency. So, we have to be careful when making inferences about what other web apps do/don't do.

"But somebody should do something!"

Not necessarily. There is no inherent responsibility from anyone at any point since there is no vulnerability in any system. The web app could be "nice" and provide visibility of the metadata or proactively strip it, but it is certainly not their responsibility.

There is only so far that technologists can save people from inherent Hazards. And because some web applications are designed to require metadata, there can't be a universal design approach that removes it. This leaves us with the potential of systems that expose the conditions for potential Hazards that don't necessarily need to be fixed.

A Supporting Example

Imagine a web app that allows people to make their own user name. There is no vulnerability in this design decision. Now imagine that a user decides to use their phone number as a username. Is there a vulnerability? No. The inherent Hazard of allowing people to create their own username can result in the Pre-Condition of people using sensitive information that could be used against them. In this case, the user is proactively exposing sensitive data, and that's on them. But how far removed is that situation from a user uploading a file with metadata that they were not aware of? Again, the weakness here is that the metadata is not obvious, which creates a Pre-Condition for Hazard. But there is no "vulnerability".

Improve this answer
2

No, it is not a vulnerability. Definitions of vulnerability may change, but in general it is something like:

Vulnerabilities are flaws in a computer system that weaken the overall security of the device/system.

This is not a flaw. The EXIF information is there by definition. You can easily remove the EXIF information if you want. Most social platforms also remove at least part of the EXIF information.

It is also unclear how this weakens the overall security, and of which system.

Even though it is debatable whether it is in scope for CVSS you could fill-in the calculator page; you'll get a score of 1.8 for what that is worth.

---- edit ---

I said that most social media platforms strip the EXIF information. Facebook, X, WHatsapp, Instagram all do that. Tiktok doesn't, AFAIK. Is than the vulnerability in Tiktok? Sftp, https etc. don't strip data either.

It is not a vulnerability of the web application. It is not a vector for compromising the web application. You may consider it as a user error, or a failure of the platform to comply with privacy legislation, but not as a vulnerability.

Improve this answer
6
  • 1
    The EXIF information is there by definition, but nobody expects or usually wants to transfer it by default. If from a public picture of your cat I can extract your home address, there's a data leak. Where is the bug leading to such a leak? It must be in the transfer process, something should have "sanitized" the pic, and that should probably be done by the web application. That's what I think.
    – reed
    Commented Nov 3, 2023 at 11:23
  • There's a setting on you camera to save geolocation information or not. It's not something you cannot control.
    – ThoriumBR
    Commented Nov 3, 2023 at 14:16
  • See added information.
    – Ljm Dullaart
    Commented Nov 3, 2023 at 14:57
  • If you were doing a security assessment of such a public forum, are you saying that you wouldn't raise this as an issue?
    – paj28
    Commented Nov 3, 2023 at 16:33
  • 1
    @paj28 A full security assessment looks at more than vulnerabilities. I would raise non-compliance with regulations as an issue, but I would not say that it is a vulnerability. Not all security issues are vulnerabilities.
    – Ljm Dullaart
    Commented Nov 3, 2023 at 21:46
0

What constitutes a vulnerability is to some degree subjective, and depends on the context of the application. There are some scenarios when this would be expected behaviour. But if this is a public forum I would flag it as a vulnerability.

The vector I would use is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N which comes out as 5.3/medium. That's assuming a public online forum (AV:N, PR:N) and rating confidentiality impact as low. I put user interaction as not required, which is debatable. CVSS isn't brilliant for these kind of flaws, but I'd say that's at least reasonably objective and defensible.

For some evidence of this being generally accepted as a vulnerability, here is a link to a bug bounty report relating to this issue, which was accepted as a vulnerability. Also, the NCSC definition of vulnerability includes user error.

Improve this answer
14
  • Yes, it's hard to calculate a CVSS score because it's basically a data leak that depends on the users' behavior, and the context. If a user doesn't post any pics, they aren't affected at all. So impact and user interaction are difficult parameters to define in CVSS, the final score could be anything between 3 and 8 I guess.
    – reed
    Commented Nov 3, 2023 at 11:46
  • But is it a system vulnerability? It's a "weakness" or a "risk" but not a "system vulnerability".
    – schroeder ♦
    Commented Nov 3, 2023 at 12:35
  • @schroeder - The question was "is it a vulnerability", not "is it a system vulnerability". In any case, it's useful to consider systems in a broad sense, which includes users.
    – paj28
    Commented Nov 3, 2023 at 13:35
  • @schroeder, a vulnerability is by definition a weakness that can be exploited. If I can find out where people live from GPS data embedded in cat pics, then it can be exploited. There's an impact on confidentiality, because users don't expect that data to be public, and they are usually not even aware such data is inside their pictures. How can this be mitigated? The only viable solution is to strip metadata in web applications after the upload, and that's what big social media are doing (Facebook, Twitter, etc.). If this is not a vulnerability (fixable in "systems"), then what is it?
    – reed
    Commented Nov 3, 2023 at 13:57
  • It's not a weakness that can be exploited, so it's just a weakness. You want to fit this into a specific box, even expecting a CVSS score, but it's a logical weakness, not a system vulnerability.
    – schroeder ♦
    Commented Nov 3, 2023 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .