search

OWASP / wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
https://owasp.org/www-project-web-security-testing-guide/
Creative Commons Attribution Share Alike 4.0 International
7.13k stars 1.31k forks source link

Adding file producer metadata leakage #788

Open Hipapheralkus opened 3 years ago

Hipapheralkus commented 3 years ago

File producer metadata leakage If the web application generates files (e.g. pdf), using exiftools (or other techniques), the Producer can be found which created it. If the producer is known, e.g. Producer: iText 2.1.7 or Producer: mPDF 7.1.7 the attacker can discover whether any CVEs exist for such a tool leading to successful exploitation.

Although I was able to find https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/, but it doesn't reference this specific need in my opinion. Therefore, I'd like to extend the Information Gathering with a new content.

Would you like to be assigned to this issue? no

kingthorin commented 3 years ago

@Hipapheralkus you said you'd like extend/add content but then didn't want the issue assigned. Do you plan to tackle the changes?

github-actions[bot] commented 2 years ago

Please comment if you are still working on this issue, as it has been inactive for 90 days. To give everyone a chance to contribute, we are releasing it to new contributors.