<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>04/25/2022 - Diary entry #496:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>VirusTotal is a free service that uses more than 50 AntiVirus engines to analyze suspicious artifacts and to provide real-time detection of files, URLs, domains, and more. When an artifact is submitted for analysis, VirusTotal's environment executes several
tools to aid during the process, such as extracting files' strings, capabilities, metadata, or getting URLs' screenshots.
<div><br>
</div>
<div>In April last year, researchers found a Remote Code Execution vulnerability by submitting weaponized samples on VirusTotal. By exploiting the vulnerability, their malicious payload was executed as soon as the ExifTool utility was used by the AntiViruses
scanners/engines. ExifTool is a platform-independent Perl library plus a command-line application for reading, writing, and editing meta information in a wide variety of files.</div>
<div><br>
</div>
<div>Tracked as CVE-2021-22204, the vulnerability is described as "improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image", according to Mitre. As soon as
it was reported to VirusTotal, it was fixed and today it was publicly disclosed.</div>
<div><br>
</div>
Since security companies rely on tools such as ExifTool to extract useful information during their sandboxed analysis, it is a must to keep all tools updated to defend against this vulnerability. Besides that, it is important to isolate all analysis environments
and monitor them to prevent upcoming vulnerabilities.<br>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
</body>
</html>