trace_9193f6f0125d4244b2921cff04a15bb5

This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start at pkg/modules/exiftool/exiftool.go in the metadata write flow. Trace how user-supplied metadata is filtered and then passed to ExifTool, and report any dangerous pseudo-tags that can still reach the ExifTool invocation in this vulnerable checkout. Ground the finding in concrete code paths and tag handling behavior.

{
  "executiveSummary": "Incomplete pseudo-tag filtering in the ExifTool metadata write path allows dangerous ExifTool pseudo-tags to survive sanitization via case-insensitive tag names and omitted HardLink/SymLink tags, enabling arbitrary file rename, move, or link creation.",
  "reports": [
    {
      "title": "Case-insensitive bypass of dangerous tag filter allows ExifTool file rename/move via FileName/Directory pseudo-tags",
      "severity": "HIGH",
      "summary": "The WriteMetadata method in pkg/modules/exiftool/exiftool.go filters only exact-case 'FileName' and 'Directory' keys from user-supplied metadata before passing them to ExifTool. Since ExifTool's tag names are case-insensitive, a user can supply 'filename', 'FILENAME', 'directory', 'DIRECTORY', etc. to bypass the filter and trigger ExifTool's file rename and move pseudo-tag side effects.",
      "rootCauseAnalysis": "The dangerousTags filter on lines 231-237 uses Go's `delete(metadata, tag)` which performs exact key matching on the map. ExifTool however treats tag names case-insensitively, so any case variant of 'FileName' or 'Directory' will be accepted by ExifTool and cause the same dangerous side effect (file rename or move) while passing through the Go filter unimpeded.",
      "impact": "An attacker can rename or move files on the server by providing metadata with case-variant keys like 'filename' or 'DIRECTORY'. This could allow overwriting critical files, moving files to attacker-controlled locations, or disrupting service by moving/renaming files the application depends on.",
      "attackPath": "1. Attacker sends an API request with PDF metadata containing a key like 'filename' (lowercase) or 'directory' (lowercase) with a malicious value.\n2. The WriteMetadata function's dangerousTags filter only checks exact 'FileName' and 'Directory' keys, so the case-variant key survives deletion.\n3. The key-value pair is passed to fileMetadata[0].SetString(key, val) or similar setter.\n4. ExifTool processes the pseudo-tag case-insensitively, triggering a file rename or directory move.",
      "stepsToReproduce": [
        "1. Submit a PDF metadata write request with metadata key 'filename' (lowercase) and value '/path/to/target/file.pdf'",
        "2. The key 'filename' is not matched by the filter which only checks 'FileName' (PascalCase)",
        "3. ExifTool interprets 'filename' as the FileName pseudo-tag and renames the file accordingly",
        "4. Similarly, 'directory' bypasses the 'Directory' filter and causes a file move"
      ],
      "vulnerableFiles": [
        "pkg/modules/exiftool/exiftool.go"
      ],
      "evidence": [
        "Lines 231-237: dangerousTags := []string{\"FileName\", \"Directory\"} followed by for _, tag := range dangerousTags { delete(metadata, tag) } — this is case-sensitive exact matching",
        "Lines 239-277: The surviving metadata keys are iterated and passed directly to fileMetadata[0].SetString/SetStrings/SetInt/SetFloat without any c