3 ms·
> GitLab Workhorse could check if the file is a valid TIFF of JPEG before passing it to ExifTool This approach doesn't work in general. An attacker could craft
by im3w1l 5y ago
> GitLab Workhorse could check if the file is a valid TIFF of JPEG before passing it to ExifTool
This approach doesn't work in general. An attacker could craft a polyglot file - and in that case it's a matter of which format is tried first. Valid tiff's could potentially be processed as something entirely different.
- setpatchaddress 5y agoYup. PoC||GTFO article (one of many, IIRC) on crafting a polyglot PDF / JPEG file: https://github.com/angea/pocorgtfo/blob/master/contents/articles/03-03.pdf https://github.com/angea/pocorgtfo/blob/master/contents/arti...
- deleted 5y ago[deleted]