Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-2815

CVE-2022-2815: Publify Core does not strip metadata from images

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-2815
GHSA ID
GHSA-79wq-g4v9-gfj4
EPSS Score
0.45463%
CWE
CWE-922
Published
1/14/2023
Updated
1/23/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
publify_corerubygems< 9.2.109.2.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Publify Core's failure to strip EXIF metadata from uploaded images. The patch introduced two new CarrierWave processes (strip and fix_exif_rotation) in ResourceUploader to address this. In vulnerable versions (<9.2.10), these processes were absent, leaving the system's image processing pipeline incomplete and allowing insecure storage of sensitive metadata. The primary vulnerable component is the image processing workflow in ResourceUploader, which lacked critical sanitization steps.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Ins**ur* Stor*** o* S*nsitiv* In*orm*tion in *it*u* r*pository pu*li*y/pu*li*y prior to *.*.**.

Reasoning

T** vuln*r**ility st*ms *rom Pu*li*y *or*'s **ilur* to strip *XI* m*t***t* *rom uplo**** im***s. T** p*t** intro*u*** two n*w **rri*rW*v* pro**ss*s (`strip` *n* `*ix_*xi*_rot*tion`) in R*sour**Uplo***r to ***r*ss t*is. In vuln*r**l* v*rsions (<*.*.**