Multiple PHP Images Galleries EXIF Metadata XSS Vulnerabilities

########################################################################
Summary :

A  large majority  of PHP  Images Gallery  Technologies now  handle  the
Exchangeable Image File  (EXIF) header of  jpeg files. The  Exchangeable
Image File  (EXIF) format  is an  international specification  that lets
imaging  companies  encode  metadata  information  into  the  headers or
application segments of a JPEG file. Unfortunately the metadata gathered
in the EXIF header are not well sanitized when displayed.

########################################################################
Details :

Displaying the  EXIF information  is a  nice feature,  and more and more
online gallery try to enable this functionnality to please their  users.
The default behavior of all  these technologies is not always  the same,
in some cases you may have to configure the gallery to display the  EXIF
info or install  an additionnal tool  (jhead for example)  to enable the
functionnality.

When,  the  setup process  is  done, the  EXIF  info will  be  displayed
automatically when clicking on the  picture (in rare cases you  may have
to request the EXIF info by clicking on an information/exif button).

When displayed, the EXIF information  is not sanitized, which makes  the
gallery technology vulnerable to cross site scripting attacks.

Vulnerable Systems:

* Coppermine (up to 1.3.3, >= beta 1.4.1 not vulnerable)
==>http://coppermine.sourceforge.net/

* Gallery 1.5.1-RC2 and prior
(in addition the photo description field was vulnerable to XSS)
==>http://gallery.menalto.com/

* phpGraphy (up to version 0.9.9a, >= 0.9.10 not vulnerable)
==>http://phpgraphy.sourceforge.net/

* YaPig 0.95 and prior
==>http://yapig.sourceforge.net/

A large number  of galleries are  available, if you  want to extend  the
test panel, try for example :
http://directory.google.com/Top/Computers/Programming/Languages/PHP/Scripts/Image_Galleries/

Commercial technologies are vulnerable too

* PhotoPost PHP Pro (current version)
==> http://www.photopost.com/

After a  short survey,  it looks  like online  images galleries  as MSN,
YAHOO,  ShutterFly,  Pixagogo,  PictureTrail  ...  don't  provide   EXIF
metadata for now. So are not affected by this vulnerability.

Release Date :
August 26, 2005

Severity :
MEDIUM

########################################################################
Example :

Take your favorite picture, and save it in .jpg. Use the EXIF editor  of
your choice and edit the Camera Model Tag. Replace the current value  by
" <script>alert(document.cookie)</script> ".

Then upload the jpeg file to  your favorite Online Gallery and click  on
the picture ... XSS.

########################################################################
Vendor Status :

The information has been provided to all concerned Project Managers  the
17th of August 2005.

* Coppermine
Update to Coppermine pg1.3.4
http://coppermine-gallery.net/forum/index.php?topic=20933.0

* Gallery
Update to the final release of Gallery 1.5.1.
http://gallery.menalto.com/modules.php?op=modload&name=phpWiki&file=index&pagename=Download
A patch for Gallery  1.5 and a new  Debian's Gallery 1.2.5 package  have
been released too.

* phpGraphy
Update to version 0.9.10
http://phpgraphy.sourceforge.net/download.php

* YaPig
No answer up to now.

* PhotoPost PHP Pro
On the 22nd of August:
"we'll be issuing an update to PhotoPost today which will sanitize  this
data before being displayed"

########################################################################
Credit :

Cedric Cochin, Network Security Expert
Web Site: http://cedri.cc
< cedric.cochin [-at-] gmail .DoT. com >

Currently  => SecureScout Product Integration Manager
Previously => netVigilance SecurityWatch Team Manager
Web Site   => http://www.securescout.com || http://www.netvigilance.com

Original Advisory link:
http://cedri.cc/advisories/EXIF_XSS.txt