Vulnerability GHSA-q7f2-rv22-2xgr

Summary

Fectura Scripts is an open-source ERP application, a sensitive information disclosure vulnerability was identified in the Library module's image upload and download pipeline. The application fails to strip EXIF and other embedded metadata from user-uploaded image files before storing them and serving them for download. As a result, any authenticated user who downloads an image from the Library can extract the original uploader's GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata.

This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access.

Technical Background

What Is EXIF/Image Metadata?

Most modern image formats (JPEG, TIFF, PNG with ancillary chunks, HEIC, WebP with XMP) embed metadata automatically at creation time. This metadata can include:

Why This Matters in an ERP Context

ERP platforms are used by businesses with multiple employees, contractors, clients, and sometimes external partners accessing shared resources. The Library module is inherently a collaborative, shared-access feature. Any image uploaded by one party is downloadable by many others — creating a one-to-many PII exposure vector.

Step 1: Prepare a Metadata-Rich Test Image

Create or obtain a JPEG image with embedded GPS and descriptive metadata. You can inject test metadata using exiftool:

exiftool \
  -GPSLatitude="48.8566" \
  -GPSLatitudeRef="N" \
  -GPSLongitude="2.3522" \
  -GPSLongitudeRef="E" \
  -GPSAltitude="35" \
  -UserComment="Confidential: Taken at employee home address" \
  -XPAuthor="John Doe" \
  -Make="Apple" \
  -Model="iPhone 15 Pro Max" \
  -DateTimeOriginal="2025:01:15 09:30:00" \
  test_image.jpg

Verify metadata is present:

exiftool test_image.jpg

Expected output should show all injected fields including GPS coordinates resolving to Paris, France (48.8566°N, 2.3522°E).

Step 3: Navigate to the Library Section

1. From the main navigation/sidebar, click on "Library" (or equivalent menu entry).
2. Confirm the Library module loads and displays existing files/images (if any).

Step 5: Download the Image (as the Same or Different User)

1. Locate the uploaded image in the Library.
2. Click the "Download" button/link (or right-click → Save As on the rendered image, depending on UI).
3. Save the file locally as downloaded_image.jpg.

Note: For stronger proof of impact, perform this step logged in as a different user account with Library access, demonstrating cross-user information leakage.

Step 7: Confirm GPS Resolution to Physical Location

Take the extracted GPS coordinates and resolve them:

https://www.google.com/maps?q=48.8566,2.3522

This confirms the metadata resolves to a precise, real-world physical location — demonstrating the severity of the leak.

Impact Assessment

Direct Impacts

Contextual / Escalated Impacts

• Regulatory Exposure: GPS coordinates and author names constitute personal data under GDPR (Art. 4(1)), CCPA, and similar frameworks. Failure to strip this data from shared/downloadable resources may constitute a data protection violation for organizations using Fectura Scripts.
• Insider Threat Amplification: A malicious insider (employee, contractor) with Library download access can silently harvest geolocation and identity data of colleagues without any logging or indication to the victim.
• Physical Security Risk: In sectors where employee physical safety is paramount (e.g., legal, law enforcement, journalism, NGOs, domestic violence support), leaking home GPS coordinates through an ERP system represents a direct physical safety threat.
• Supply Chain Risk: If the Library is shared with external partners/vendors, the exposure surface extends beyond the organization.

Why CVSS 6.5 Understates the Risk

The CVSS base score of 6.5 reflects the mechanical characteristics of the vulnerability (network-accessible, low complexity, authenticated). However, the contextual severity is higher because:

1. Users have no expectation that uploading an image to an ERP system will broadcast their home coordinates.
2. The attack is completely passive — the attacker simply downloads a file; no exploitation toolkit or special skills are required.
3. The leaked data (GPS, PII) is irrevocable — once downloaded, the victim cannot "un-leak" their location.
4. The vulnerability affects every image ever uploaded to the Library, creating a retroactive exposure of historical data.

Recommended effective severity: HIGH for any deployment handling real employee/client data.

9. References