{"metadata": {"vulnerability": "CVE-2021-22204", "count": 94, "kinds": {"milestone": 6, "sighting": 53, "kev": 11, "other": 24}}, "data": [{"timestamp": "2021-01-05T00:00:00Z", "date_only": false, "value": "2021-01-05T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-22204", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-04-23T17:22:15Z", "date_only": false, "value": "2021-04-23T17:22:15.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-22204", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9377-7HWR-P4W6", "record": "GHSA-9377-7HWR-P4W6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2021-22204", "record": "UBUNTU-CVE-2021-22204", "field": "published"}, {"timestamp": "2021-04-23T18:15:00Z", "date_only": false, "value": "2021-04-23T18:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-22204", "record": "GSD-2021-22204", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-04-23T18:15:08.127Z", "date_only": false, "value": "2021-04-23T18:15:08.127", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22204", "record": "FKIE_CVE-2021-22204", "field": "published"}, {"timestamp": "2021-04-24T09:07:19Z", "date_only": false, "value": "2021-04-24T09:07:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reconshell/687", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "4983a08d-7088-44e8-8afd-854ac441366c", "content": "CVE-2021-22204\n\nImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image\n\nhttps://cve.reconshell.com/cve/CVE-2021-22204", "url": "https://t.me/reconshell/687"}, {"timestamp": "2021-04-25T00:00:00Z", "date_only": true, "value": "2021-04-25", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-39938", "record": "CNVD-2021-39938", "field": "submitTime"}, {"timestamp": "2021-04-26T11:02:21Z", "date_only": false, "value": "2021-04-26T11:02:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3219", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "b987319d-1e1d-4ebb-bc98-f95e09edabe1", "content": "#Analytics\n10 most exploited vulnerabilities of the week (April 19-25)\nCVE-2021-3156 Heap-Based Buffer Overflow in Sudo\nhttps://t.me/cybersecuritytechnologies/2577\nCVE-2021-1732 Win kernel 0-day\nhttps://t.me/cybersecuritytechnologies/2679\nCVE-2021-22893 Pulse SecureVPN RCE\nhttps://t.me/cybersecuritytechnologies/3185\nCVE-2021-22204 Improper neutralization of user data in DjVu\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-26415 Win Installer EoP\nhttps://t.me/cybersecuritytechnologies/3186\nCVE-2021-3493 OverlayFS PE\nhttps://t.me/cybersecuritytechnologies/3164\nCVE-2021-26413 Win Installer Spoofing\nhttps://t.me/cybersecuritytechnologies/3176\nCVE-2016-7836 SKYSEA Client View Arbitrary Code Exec\nhttps://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software\nCVE-2021-27905 Apache Solr SSRF\nhttps://t.me/cybersecuritytechnologies/3213", "url": "https://t.me/CyberSecurityTechnologies/3219"}, {"timestamp": "2021-05-02T07:56:58Z", "date_only": false, "value": "2021-05-02T07:56:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cKure/5126", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "0ae0b746-588a-4f73-b178-1624cdfa5e64", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 RCE on exiftool (CVE-2021-22204).", "url": "https://t.me/cKure/5126"}, {"timestamp": "2021-05-10T18:41:24Z", "date_only": false, "value": "2021-05-10T18:41:24Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2021-05-10T18:41:24Z", "date_only": false, "value": "2021-05-10T18:41:24Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2021-05-10T18:41:24Z", "date_only": false, "value": "2021-05-10T18:41:24Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "document.tracking.generator.date"}, {"timestamp": "2021-05-10T18:41:24Z", "date_only": false, "value": "2021-05-10T18:41:24Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2021-05-11T09:56:55Z", "date_only": false, "value": "2021-05-11T09:56:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pwnwiki_zhchannel/402", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "bbf56287-ab88-4e09-848b-02f1311b3f52", "content": "CVE-2021-22204 ExifTool\u4efb\u610f\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-22204_ExifTool%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "url": "https://t.me/pwnwiki_zhchannel/402"}, {"timestamp": "2021-05-11T21:49:48Z", "date_only": false, "value": "2021-05-11T21:49:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/fileformat/exiftool_djvu_ant_perl_injection.rb", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "0727b3e1-9846-4086-a67b-778d925553dd", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/fileformat/exiftool_djvu_ant_perl_injection.rb"}, {"timestamp": "2021-05-14T22:54:08Z", "date_only": false, "value": "2021-05-14T22:54:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/5329", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "1c577dbd-aa78-467c-b3db-c7425e988e60", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 ExifTool CVE-2021-22204 - Arbitrary Code Execution.\n\nhttps://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html", "url": "https://t.me/cKure/5329"}, {"timestamp": "2021-05-15T13:37:04Z", "date_only": false, "value": "2021-05-15T13:37:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bhhub/278", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "5a0a8650-5e04-4ccc-9291-2e91d00ed50e", "content": "#BugBountyTips of the Day\nHere\u2019s a writeup of the recent ExifTool bug (CVE-2021-22204) I discovered while  working on the #bugbounty program at @gitlab!  Issue was in the DjVu module but can be embedded it most other formats.  Make sure to patch GitLab and ExifTool!   https://t.co/sWxkHPTRJS\n---\nGitLab disclosed a bug submitted by @wcbowling:  https://t.co/AT5tpl2rqG - Bounty: $20,000 #hackerone #bugbounty  https://t.co/9CGRh55hEj\n---\nNuclei Templates v8.2.7 release comes with improved templates for springboot.  Here is how you can quickly run templates to scan for springboot based security issues.  \ud835\uddfb\ud835\ude02\ud835\uddf0\ud835\uddf9\ud835\uddf2\ud835\uddf6 -\ud835\ude02 \ud835\uddf5\ud835\uddfc\ud835\ude00\ud835\ude01 -\ud835\ude01\ud835\uddee\ud835\uddf4\ud835\ude00 \ud835\ude00\ud835\uddfd\ud835\uddff\ud835\uddf6\ud835\uddfb\ud835\uddf4\ud835\uddef\ud835\uddfc\ud835\uddfc\ud835\ude01  #hackwithautomation #pentest #cybersecurity #bugbounty  https://t.co/FBXHPYn1MU\n---\nFile Upload Attacks(Part1)   https://t.co/Q7ncD8v97V  #Hackenews #bugbonty #bugbountytips #infosec #cybersecurity #bugbountytip #Linux  https://t.co/nDQMpvgfIe\n---\nI found RCE in Facebook and got $7500 bounty from Facebook #bugbounty #infosec #infosecgirl #CyberSecurity  https://t.co/3CwycDGPDl\n---\nI earned $200 for my submission on bugcrowd. My first bounty \ud83d\ude0a  @bugcrowd  #ItTakesACrowd #bugbounty #bughunting #infosec #security  https://t.co/hRHBB04EyF\n---\nLol. got my ip banned again, def need to distribute my reconftw scans with axiom and smash my nmaps using unimap .. Oh and here's a fresh #bountythursdays video for you! Good times!     https://t.co/qVqhpiYA78  #CyberSecurity #bugbounty #pentesting #offensivesecurity  https://t.co/8JYMdyI1rt\n---\nI made $0 this week on bug bounties, and $50 an hour pentesting.  #bugbountytips\n---\n#BugBounty Hunters and other #infosec friends \ud83d\ude0d Want to practice your WAF bypass skills?   Feel free to bash on our WAF all you want \ud83e\udd29\ud83e\udd73   http://139.162.232.63/WAF.php?keyword=test#\n---\nMass Assignment exploitation in the wild - Escalating privileges in style  A blog post about a Mass Assignment vulnerability which allowed me to escalate privileges from normal user to administrator with a single POST request.   https://t.co/pSbcfIZcov  #bugbountytips #bugbounty\n---\nnote to self..  Spend less time tweeting and more time hacking,  #bugbountytips\n---\nAwesome Bug Bounty One Liners - Repo:  https://t.co/NapJ5fmWeU - Credit: @TomNomNom for the example in the screenshot \u2665 - #bugbountytips #bugbounty #cybersecurity #hackerone #bugcrowd #infosec #ctf  https://t.co/ojJa257aPH", "url": "https://t.me/bhhub/278"}, {"timestamp": "2021-05-16T02:08:54Z", "date_only": false, "value": "2021-05-16T02:08:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverse_dungeon/515", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "9b1c4f76-c835-4f12-b86e-83897a61da40", "content": "A CTF-style walkthrough of the recent Exiftool arbitrary code execution vuln (CVE-2021-22204) - https://blog.bricked.tech/posts/exiftool/", "url": "https://t.me/reverse_dungeon/515"}, {"timestamp": "2021-05-16T17:27:59Z", "date_only": false, "value": "2021-05-16T17:27:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reconshell/705", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "8955b034-f754-47e1-a843-e2152cf40d6d", "content": "CVE-2021-22204\n\nImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image\n\nhttps://cve.reconshell.com/cve/CVE-2021-22204", "url": "https://t.me/reconshell/705"}, {"timestamp": "2021-05-17T19:44:30Z", "date_only": false, "value": "2021-05-17T19:44:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ptswarm/37", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "1101ed02-acb9-4491-95e0-8bf57e245e28", "content": "ExifTool CVE-2021-22204 - Arbitrary Code Execution discovered by @vakzz.\n\nThe story of finding an ImageTragick-esque vulnerability, originally in gitlab. Go down the rabbit hole of image parsing with perl!\n\nContents:\n \u2022 Background\n \u2022 The Bug\n \u2022 Additional Formats\n \u2022 Bonus Formats\n \u2022 References\n\nhttps://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html", "url": "https://t.me/ptswarm/37"}, {"timestamp": "2021-05-19T08:06:32Z", "date_only": false, "value": "2021-05-19T08:06:32.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/4086", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "3fa09414-ac6b-47af-88a1-0da260230305", "content": "\u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435\u0441\u044c ExifTool, \u0442\u043e \u0432\u0430\u043c \u0430\u043f\u0434\u0435\u0439\u0442! \n\nhttps://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html", "url": "https://t.me/alexmakus/4086"}, {"timestamp": "2021-05-31T00:00:00Z", "date_only": true, "value": "2021-05-31", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-39938", "record": "CNVD-2021-39938", "field": "openTime"}, {"timestamp": "2021-10-01T09:39:06Z", "date_only": false, "value": "2021-10-01T09:39:06.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/e5b7acd7-edb8-4bf3-99c3-8706ff3a9a71", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "060b00cc-7eec-41aa-873b-edec66f48506"}, {"timestamp": "2021-11-03T21:17:46Z", "date_only": false, "value": "2021-11-03T21:17:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "4cdfab56-ac97-4dfe-a4a8-2287f9992332", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "timestamps.asserted_at", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-22204", "field": "timestamps.asserted_at", "uuid": "31bae852-f3e1-45e5-a966-52cd9297385b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22204", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-22204", "record": "GSD-2021-22204", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-22204", "field": "evidence.0.details.added_date", "uuid": "31bae852-f3e1-45e5-a966-52cd9297385b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "evidence.0.details.date_added", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "timestamps.first_seen_at", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-22204", "field": "timestamps.first_seen_at", "uuid": "31bae852-f3e1-45e5-a966-52cd9297385b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "status.status_updated_at", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-22204", "field": "status.status_updated_at", "uuid": "31bae852-f3e1-45e5-a966-52cd9297385b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": false, "value": "2021-11-17T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22204", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2021-11-20T09:53:52Z", "date_only": false, "value": "2021-11-20T09:53:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "a9e5a75f-8a7b-49aa-8ddd-ca577be58d36"}, {"timestamp": "2021-12-01T00:00:00Z", "date_only": true, "value": "2021-12-01", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "evidence.0.details.due_date", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-12-01T00:00:00Z", "date_only": true, "value": "2021-12-01", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-22204", "record": "GSD-2021-22204", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2022-01-24T06:31:11Z", "date_only": false, "value": "2022-01-24T06:31:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hack_room_channel/148", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "835cb3f7-c973-412d-842f-44f5370ca64f", "content": "CVE-2021-22204\n\nImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image. \n\nhttps://github.com/LazyTitan33/CVE-2021-22204", "url": "https://t.me/hack_room_channel/148"}, {"timestamp": "2022-01-24T06:32:07Z", "date_only": false, "value": "2022-01-24T06:32:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hack_room_channel/149", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "db688869-20e2-4b4d-a3ec-38a7ca1fab6e", "content": "CVE-2021-22204\n\nUne neutralisation incorrecte des donn\u00e9es utilisateur dans le format de fichier DjVu dans les versions 7.44 et ult\u00e9rieures d'ExifTool permet l'ex\u00e9cution de code arbitraire lors de l'analyse de l'image malveillante.\n\nhttps://github.com/LazyTitan33/CVE-2021-22204", "url": "https://t.me/hack_room_channel/149"}, {"timestamp": "2022-01-30T03:13:33Z", "date_only": false, "value": "2022-01-30T03:13:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1448", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "f9f91f81-f962-402b-818f-3af293b8857c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA complete PoC for CVE-2021-22204 exiftool RCE \nURL\uff1ahttps://github.com/0xBruno/CVE-2021-22204", "url": "https://t.me/GithubRedTeam/1448"}, {"timestamp": "2022-04-25T22:15:20Z", "date_only": false, "value": "2022-04-25T22:15:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/m1swarr1or/91", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "3a2a60b6-a37d-4f9b-9944-09932b669ce8", "content": "\u041e\u0443, \u043c\u0430\u0439. \u0422\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0445 \u044d\u043d\u0442\u0435\u0440\u043f\u0440\u0430\u0439\u0437 \u0430\u043f\u0438)) \n\n\u041f\u043e\u043b\u043e\u043c\u0430\u043b\u0438 \u0432\u0435\u0441\u044c\u043c\u0430 \u0437\u0430\u0431\u0430\u0432\u043d\u043e, CVE-2021-22204 \u043d\u0430 rce \u0447\u0435\u0440\u0435\u0437 djvu \u0444\u043e\u0440\u043c\u0430\u0442 \u0432 exiftool. \u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u0442\u043e\u0442\u0430\u043b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 exiftool \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0445\u043e\u0441\u0442\u0430\u0445, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0447\u0435\u043b\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0440\u0435\u0432\u0435\u0440\u0441 \u0448\u0435\u043b\u043b \u0447\u0435\u0440\u0435\u0437 \u0432\u043e\u0442 \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u043d\u0430 \u0430\u043d\u0430\u043b\u0438\u0437.\n\ncontent: (metadata \"\\c${system('bash -c \\\"{echo,BASE64-ENCODED-COMMAND-TO-BE-EXECUTED }|{base64,-d }|{bash,-i }\\\" ; clear') };\")", "url": "https://t.me/m1swarr1or/91"}, {"timestamp": "2022-04-26T13:58:09Z", "date_only": false, "value": "2022-04-26T13:58:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/2887", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "1c069330-1b65-4b0a-b8cc-9223c8c28562", "content": "\u034f\u041e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u043e\u0433\u0434\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0435\u0440\u0435\u0436\u0435\u043d\u0438\u0435 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u0443\u0433\u0440\u043e\u0437\u043e\u0439.\n\n\u042d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0438\u0437 Cysource \u043d\u0435 \u043f\u043e\u043b\u0435\u043d\u0438\u043b\u0438\u0441\u044c \u0438 \u0440\u0435\u0448\u0438\u043b\u0438 \u043e\u0442\u0430\u0443\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0430\u043c VirusTotal \u0438 \u043a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0448\u043b\u043e \u044d\u0442\u043e \u0443 \u043d\u0438\u0445 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 VirusTotal \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0434\u0438\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445-\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0434\u0432\u0438\u0436\u043a\u0438.\n\n\u0411\u0430\u0433\u0443 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0438 \u0435\u0449\u0435 13 \u0430\u043f\u0440\u0435\u043b\u044f 2021 \u0433\u043e\u0434\u0430, \u043d\u043e \u0434\u043b\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 RCE \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b.\n\n\u041c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 DjVu \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0435\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 ExifTool - \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 EXIF \u0432 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u0445 \u0438 PDF-\u0444\u0430\u0439\u043b\u0430\u0445.\n\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a CVE-2021-22204 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0446\u0435\u043d\u043a\u0443 7,8 \u043f\u043e CVSS \u0438 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041a\u0430\u043a \u043c\u044b \u043f\u043e\u043c\u043d\u0438\u043c VirusTotal, \u0432\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u043f\u043e\u0434\u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Google Chronicle \u0438 \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437, \u043a\u043e\u0433\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0444\u0430\u0439\u043b \u0441 \u043d\u043e\u0432\u043e\u0439 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439, VirusTotal \u0431\u043b\u0430\u0433\u043e\u043f\u043e\u043b\u0443\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u044d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0434\u0440\u0443\u0433\u0438\u043c \u0445\u043e\u0441\u0442\u0430\u043c. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043f\u043e\u043c\u0438\u043c\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0435\u0449\u0435 \u0438 \u0441\u0430\u043c\u0430 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u043f\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 Google \u0435\u0451 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0438 \u043f\u0430\u0440\u0442\u043d\u0451\u0440\u0430\u043c.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u043e\u043c\u0438\u043c\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Google, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043a 50 \u0445\u043e\u0441\u0442\u0430\u043c, \u043f\u0440\u0438\u0447\u0451\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u044b\u043b \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0440\u0435\u0431\u044f\u0442\u0430 \u043d\u0435 \u0441\u043f\u0435\u0448\u0438\u043b\u0438 \u0441 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.", "url": "https://t.me/true_secator/2887"}, {"timestamp": "2022-04-27T17:59:50Z", "date_only": false, "value": "2022-04-27T17:59:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/NeKaspersky/2173", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "2fd949c4-08f7-46d2-ba79-89c6034ce902", "content": "\u041c\u043d\u043e\u0433\u043e \u0448\u0443\u043c\u0430 \u0438\u0437 \u043d\u0438\u0447\u0435\u0433\u043e, \u0438\u043b\u0438 \u043a\u0430\u043a \u0432 VirusTotal RCE \u043d\u0430\u0448\u043b\u0438\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Cysource \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438, \u0447\u0442\u043e \u0433\u0443\u0433\u043b\u043e\u0432\u0441\u043a\u0438\u0439 VirusTotal \u043c\u043e\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0430\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u0430\u0441\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0440\u044f\u0434 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e ExifTool, \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u043a CVE-2021-22204 (7.8 CVSS). \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0432\u0435\u0442\u043d\u043e\u0433\u043e reverse shell-\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u043b\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u0430\u0439\u0442\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DjVu-\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0447\u0442\u043e-\u0442\u043e \u043d\u0430\u043f\u043e\u0434\u043e\u0431\u0438\u0435 content: (metadata \"\\c${system('bash -c \\\"{echo,\u0432\u0430\u0448_\u043f\u0435\u0439\u043b\u043e\u0434_\u0432_base64 }|{base64,-d }|{bash,-i }\\\" ; clear') };\") \u0438, \u043f\u043e\u0442\u0438\u0440\u0430\u044f \u0440\u0443\u043a\u0438 \u0438 \u0437\u043b\u043e\u0431\u043d\u043e \u0441\u043c\u0435\u044f\u0441\u044c, \u043e\u0436\u0438\u0434\u0430\u0442\u044c.\n\n\u041e \u0431\u0430\u0433\u0435 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438, \u0435\u0433\u043e \u0441\u0442\u043e\u043b\u044c \u0436\u0435 \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u043e\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0438 \u0442.\u0434, \u043d\u043e \u0441\u0443\u0442\u044c \u0441\u043b\u0435\u0433\u043a\u0430 \u0432 \u0434\u0440\u0443\u0433\u043e\u043c: \u0432\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u0430\u043a \u043f\u043e\u043d\u044f\u0442\u043d\u043e \u0438\u0437 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f, \u043a\u043e\u0441\u044f\u043a \u0431\u044b\u043b \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0435 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b VT, \u0432\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u043f\u0440\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 (\u0437\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u043d\u0435\u043f\u043e\u0444\u0438\u043a\u0448\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0431\u0430\u0433\u0430) \u0442\u0435\u0445 \u0436\u0435 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446, \u043f\u0440\u0438 \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u043d\u0438\u0438 \u043e\u0442\u0442\u0443\u0434\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u043d\u0438\u0447\u0435\u0433\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e. \u0412 \u043e\u0431\u0449\u0435\u043c, \u043d\u0435 \u0432\u0435\u0434\u0438\u0442\u0435\u0441\u044c \u043d\u0430 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438, \u0434\u0440\u0443\u0437\u044c\u044f.\n@NeKaspersky", "url": "https://t.me/NeKaspersky/2173"}, {"timestamp": "2022-05-11T17:06:12Z", "date_only": false, "value": "2022-05-11T17:06:12.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2021-22204", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-05-24T17:48:43Z", "date_only": false, "value": "2022-05-24T17:48:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9377-7HWR-P4W6", "record": "GHSA-9377-7HWR-P4W6", "field": "published"}, {"timestamp": "2022-07-27T16:29:00Z", "date_only": false, "value": "2022-07-27T16:29Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-22204", "record": "GSD-2021-22204", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-11-10T19:46:04Z", "date_only": false, "value": "2023-11-10T19:46:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/42", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "aeb206a2-7c08-47e5-92c9-709f4bd1e5a4", "content": "#ExploitObserverAlert\n\nCVE-2021-22204\n\nDESCRIPTION: Exploit Observer has 84 entries related to CVE-2021-22204. Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image\n\nFIRST-EPSS: 0.875560000\nNVD-IS: 5.9\nNVD-ES: 1.8", "url": "https://t.me/arpsyndicate/42"}, {"timestamp": "2023-12-13T01:23:24.115Z", "date_only": false, "value": "2023-12-13T01:23:24.115825Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-22204", "record": "GSD-2021-22204", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-04-30T17:11:44Z", "date_only": false, "value": "2024-04-30T17:11:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3279", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "d4ab0ea4-18ce-44e8-82a3-d62804ed8442", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-22893 Pulse SecureVPN RCE\nhttps://t.me/cybersecuritytechnologies/3185\nCVE-2021-28310 - Win32k EoP Vulnerability\nhttps://t.me/cybersecuritytechnologies/3124\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\nhttps://t.me/cybersecuritytechnologies/3126\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\nhttps://t.me/cybersecuritytechnologies/3156\nCVE-2021-28480/28482 - MS Exchange Server RCE\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "url": "https://t.me/CyberSecurityTechnologies/3279"}, {"timestamp": "2024-08-03T18:37:18.092Z", "date_only": false, "value": "2024-08-03T18:37:18.092Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-22204", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-28T16:48:46Z", "date_only": false, "value": "2024-09-28T16:48:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3506", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "6293612a-587a-4a6b-b704-3f1c64c24491", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (may 1-31)\nCVE-2021-31166 - HTTP Stack RCE\nhttps://t.me/cybersecuritytechnologies/3388\nCVE-2021-21551 -Dell BIOS Driver PE\nhttps://t.me/cybersecuritytechnologies/3293\nCVE-2021-30747 -Covert channel in Apple M1\nhttps://t.me/cybersecuritytechnologies/3472\nCVE-2021-22204 -DjVu vuln\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-28482 -MS Exchange RCE\nhttps://t.me/cybersecuritytechnologies/3286\nCVE-2021-21974 -VMware\u00a0ESXi heap-overflow\nhttps://t.me/cybersecuritytechnologies/3460\nCVE-2021-29447 -WordPress XXE\nhttps://t.me/cybersecuritytechnologies/3142\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-32471 -ACE in TuringMachine\nhttps://t.me/cybersecuritytechnologies/3364\nCVE-2021-3490 -Linux Kernel eBPF\nhttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e", "url": "https://t.me/CyberSecurityTechnologies/3506"}, {"timestamp": "2024-12-24T20:25:23.273Z", "date_only": false, "value": "2024-12-24T20:25:23.273429Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971175", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "19d560e4-79ff-47c4-95f2-250e03342863", "url": "https://feedsin.space/feed/CISAKevBot/items/2971175"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "e31545cb-3ee7-4430-b6a7-f9ed445fa42f"}, {"timestamp": "2025-02-06T19:49:52.310Z", "date_only": false, "value": "2025-02-06T19:49:52.310831Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22204", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-06T19:49:52.310Z", "date_only": false, "value": "2025-02-06T19:49:52.310831Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22204", "record": "FKIE_CVE-2021-22204", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-23T02:09:52Z", "date_only": false, "value": "2025-02-23T02:09:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "d7ea1640-f2cd-462c-8c87-c2de1de7dff2"}, {"timestamp": "2025-02-23T04:10:34Z", "date_only": false, "value": "2025-02-23T04:10:34.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "05e6867d-1d52-46ff-893a-10b3d440892a"}, {"timestamp": "2025-07-18T16:46:38Z", "date_only": false, "value": "2025-07-18T16:46:38Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2021-22204", "record": "UBUNTU-CVE-2021-22204", "field": "modified"}, {"timestamp": "2025-08-31T03:01:37Z", "date_only": false, "value": "2025-08-31T03:01:37.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "f8c5dfa3-c592-4999-9046-fbefbd8ef851"}, {"timestamp": "2025-10-21T23:25:48.455Z", "date_only": false, "value": "2025-10-21T23:25:48.455Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-22204", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:25:48.455Z", "date_only": false, "value": "2025-10-21T23:25:48.455Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-22204", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:07Z", "date_only": false, "value": "2025-10-22T00:32:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9377-7HWR-P4W6", "record": "GHSA-9377-7HWR-P4W6", "field": "modified"}, {"timestamp": "2025-10-28T09:00:04Z", "date_only": false, "value": "2025-10-28T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/d-rVDZTUKUG3IYUJ4BAdDnIieq971JGpK_Ia99hM3eRIwok", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "333661fb-5c31-42ab-8102-16b077c9d5af"}, {"timestamp": "2026-02-02T12:28:32.701Z", "date_only": false, "value": "2026-02-02T12:28:32.701024Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/55d4bde7-37fe-41ed-9329-04b2602082a8", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "edd2f633-5032-49dd-b4d0-dae7200897af", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/55d4bde7-37fe-41ed-9329-04b2602082a8"}, {"timestamp": "2026-02-02T12:28:32.701Z", "date_only": false, "value": "2026-02-02T12:28:32.701024Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/55d4bde7-37fe-41ed-9329-04b2602082a8", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "b0aacda8-2478-47c7-b603-f01f4e9a7684", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/55d4bde7-37fe-41ed-9329-04b2602082a8"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-22204", "field": "timestamps.recorded_at", "uuid": "3e169a5e-8126-4817-aca0-1fadc0abf4c2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-05-14T15:00:07Z", "date_only": false, "value": "2026-05-14T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8KrClztxOpt43Dn04vWbNfDSJz2auxqrQryTcHMCR_fwseY", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "58f08749-b953-4d18-b3d0-d75e7b087993"}, {"timestamp": "2026-05-20T09:25:35.973Z", "date_only": false, "value": "2026-05-20T09:25:35.973520Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-dda276fb-398aac03703b8c4f", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "c78c5754-e58c-49f8-af6d-0699a0a8a46b", "url": "https://poliverso.org/objects/0477a01e-dda276fb-398aac03703b8c4f"}, {"timestamp": "2026-05-22T14:00:08Z", "date_only": false, "value": "2026-05-22T14:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8234", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "65804777-c0e3-41d0-b802-74084d4a4a69", "url": "https://t.me/true_secator/8234"}, {"timestamp": "2026-06-13T15:00:07Z", "date_only": false, "value": "2026-06-13T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rpU8_0BAIqup9jbze7w25ozrvXdkaGKGrrCImb0BnEmBLEk", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "cc2d73fe-0ca2-4f8a-bb96-2afb35e39cac"}, {"timestamp": "2026-06-17T03:36:47.890Z", "date_only": false, "value": "2026-06-17T03:36:47.890", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-22204", "record": "FKIE_CVE-2021-22204", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:44.395Z", "date_only": false, "value": "2026-06-19T12:47:44.395462Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/813d0c77-0591-4077-92ae-b9cef9d09cc9", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "b9df7672-d2d3-443a-aab2-3b1a90ad39f8", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/813d0c77-0591-4077-92ae-b9cef9d09cc9"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-22204", "field": "timestamps.recorded_at", "uuid": "31bae852-f3e1-45e5-a966-52cd9297385b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:25.552Z", "date_only": false, "value": "2026-06-23T11:13:25.552271Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/31bae852-f3e1-45e5-a966-52cd9297385b", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "b4fd135b-275f-47f5-87ea-148a89405be3", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/31bae852-f3e1-45e5-a966-52cd9297385b"}, {"timestamp": "2026-06-23T14:04:50.496Z", "date_only": false, "value": "2026-06-23T14:04:50.496142Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/66b9d184-37ef-42cb-9a7f-6b4f671a8602", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "a1c63c56-d9df-4a55-aae8-c7e553e8c16e", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/66b9d184-37ef-42cb-9a7f-6b4f671a8602"}, {"timestamp": "2026-07-13T22:00:43.278Z", "date_only": false, "value": "2026-07-13T22:00:43.278308Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/88624", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "ccaa7c2d-9b01-4ffa-ae19-03eb04c1c7a0", "url": "https://t.me/GithubRedTeam/88624"}, {"timestamp": "2026-07-14T00:00:42.417Z", "date_only": false, "value": "2026-07-14T00:00:42.417470Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/88624", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "e90ea243-077b-49af-bed4-7370271f1444", "url": "https://t.me/GithubRedTeam/88624"}, {"timestamp": "2026-07-15T00:00:05.865Z", "date_only": false, "value": "2026-07-15T00:00:05.865196Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/88624", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "be209d82-b903-40e1-b82e-94f146012550", "url": "https://t.me/GithubRedTeam/88624"}, {"timestamp": "2026-07-29T12:02:57.379Z", "date_only": false, "value": "2026-07-29T12:02:57.379197Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1261", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "e4ae6f77-bddd-40ce-b2dc-db859e01e408", "url": "https://t.me/reverseame/1261"}, {"timestamp": "2026-07-30T01:02:01.711Z", "date_only": false, "value": "2026-07-30T01:02:01.711299Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1261", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "53232ce3-f0a6-4c8c-99e8-4f118b57cbe6", "url": "https://t.me/reverseame/1261"}, {"timestamp": "2026-08-03T10:22:50.275Z", "date_only": false, "value": "2026-08-03T10:22:50.275137Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/1261", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "f4617fb4-a389-4c58-99b7-ac0c7151dcaf", "url": "https://t.me/reverseame/1261"}, {"timestamp": "2026-08-04T00:00:43.212Z", "date_only": false, "value": "2026-08-04T00:00:43.212480Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/1261", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "066a8ae0-c261-4087-9c6a-b2fc6f23d1ba", "url": "https://t.me/reverseame/1261"}, {"timestamp": "2026-09-01T17:00:51.367Z", "date_only": false, "value": "2026-09-01T17:00:51.367651Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/3093", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "37e6a4fd-e344-4a93-952d-4dd96cfeacdc", "url": "https://t.me/cissp/3093"}, {"timestamp": "2026-09-01T20:01:41.637Z", "date_only": false, "value": "2026-09-01T20:01:41.637344Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/53061", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "9c5906b5-1a2d-48a6-80d5-8d73abdea644", "url": "https://t.me/hacking_Attack/53061"}, {"timestamp": "2026-09-01T20:02:09.052Z", "date_only": false, "value": "2026-09-01T20:02:09.052645Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/31748", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "65a4c149-bdec-4b61-8a89-76ed522a6f36", "url": "https://t.me/hacking_Attack/31748"}, {"timestamp": "2026-09-01T20:02:41.762Z", "date_only": false, "value": "2026-09-01T20:02:41.762760Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/8514", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "db2e1fbc-0c00-4636-9492-2c1d6ab20024", "url": "https://t.me/hacking_Attack/8514"}, {"timestamp": "2026-09-02T06:00:17.470Z", "date_only": false, "value": "2026-09-02T06:00:17.470064Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Russian_OSINT/7195", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "025a4007-5a3d-42aa-ad86-800e298ac6db", "url": "https://t.me/Russian_OSINT/7195"}, {"timestamp": "2026-09-05T22:00:05.264Z", "date_only": false, "value": "2026-09-05T22:00:05.264602Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/53061", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "bde679cc-cfc4-4fb8-886f-33476a000344", "url": "https://t.me/hacking_Attack/53061"}, {"timestamp": "2026-09-07T05:00:06.011Z", "date_only": false, "value": "2026-09-07T05:00:06.011991Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/31748", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "88bf58a2-bcd8-44bc-a64f-1c6096a98492", "url": "https://t.me/hacking_Attack/31748"}, {"timestamp": "2026-09-08T06:00:04.576Z", "date_only": false, "value": "2026-09-08T06:00:04.576960Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/8514", "record": "CVE-2021-22204", "field": "creation_timestamp", "uuid": "b56449a4-bf06-46e6-be3f-15b84ca40333", "url": "https://t.me/hacking_Attack/8514"}, {"timestamp": "2026-09-20T19:24:45Z", "date_only": false, "value": "2026-09-20T19:24:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T19:24:45Z", "date_only": false, "value": "2026-09-20T19:24:45Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2021:0707-1", "record": "OPENSUSE-SU-2021:0707-1", "field": "document.tracking.current_release_date"}]}