{"id":19236452,"url":"https://github.com/infobyte/cve-2023-21036","last_synced_at":"2025-09-25T21:15:29.072Z","repository":{"id":174326754,"uuid":"617519255","full_name":"infobyte/CVE-2023-21036","owner":"infobyte","description":"Detection and sanitization for Acropalypse Now - CVE-2023-21036","archived":false,"fork":false,"pushed_at":"2023-05-15T12:12:33.000Z","size":1059,"stargazers_count":81,"open_issues_count":0,"forks_count":5,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-09-12T00:47:21.439Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/infobyte.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-22T14:59:42.000Z","updated_at":"2025-09-02T05:27:24.000Z","dependencies_parsed_at":"2023-07-05T07:16:27.181Z","dependency_job_id":null,"html_url":"https://github.com/infobyte/CVE-2023-21036","commit_stats":null,"previous_names":["infobyte/cve-2023-21036"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/infobyte/CVE-2023-21036","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infobyte%2FCVE-2023-21036","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infobyte%2FCVE-2023-21036/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infobyte%2FCVE-2023-21036/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infobyte%2FCVE-2023-21036/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/infobyte","download_url":"https://codeload.github.com/infobyte/CVE-2023-21036/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infobyte%2FCVE-2023-21036/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276983436,"owners_count":25739927,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-25T02:00:09.612Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T16:20:39.350Z","updated_at":"2025-09-25T21:15:29.056Z","avatar_url":"https://github.com/infobyte.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Acropalypse detection and sanitization tools\n\nYou can use the python script `acropalypse_detection.py` or the yara rule `acropalypse_detection.yar` to detect cropped images affected by acropalypse:\n\n```\n$ for i in test_imgs/*; do python3 acropalypse_detection.py $i; done\ntest_imgs/windows10_snipping_tool_1_cropped.png\ntest_imgs/windows10_snipping_tool_2_cropped.png\ntest_imgs/windows10_snipping_tool_3_cropped.jpg\ntest_imgs/windows11_1_cropped.png\ntest_imgs/windows11_2_cropped.png\ntest_imgs/windows11_3_cropped.jpg\n```\n\n```\n$ yara acropalypse_detection.yar -r test_imgs/\nwarning: rule \"acropalypse_jpeg\" in acropalypse_detection.yar(31): string \"$a\" may slow down scanning\nacropalypse_jpeg test_imgs//windows11_3_cropped.jpg\nacropalypse_png test_imgs//windows10_snipping_tool_1_cropped.png\nacropalypse_png test_imgs//windows10_snipping_tool_2_cropped.png\nacropalypse_png test_imgs//windows11_2_cropped.png\nacropalypse_png test_imgs//windows11_1_cropped.png\nacropalypse_jpeg test_imgs//windows10_snipping_tool_3_cropped.jpg\n```\n\nThe cropped images are valid PNG images that end with an IEND chunk.\nBut data from the original image remains after this chunk.\nThe detection script and rule search for another IEND chunk at the end of the file that corresponds to the original image.\n\nYou can sanitize affected images using `acropalypse_sanitizer.py`:\n\n```\n$ for i in test_imgs/*; do python3 acropalypse_sanitizer.py $i; done\nSaving sanitized file as test_imgs/windows10_snipping_tool_1_cropped_sanitized.png\ntest_imgs/windows10_snipping_tool_1_cropped_sanitized.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\ntest_imgs/windows10_snipping_tool_1.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\nSaving sanitized file as test_imgs/windows10_snipping_tool_2_cropped_sanitized.png\ntest_imgs/windows10_snipping_tool_2_cropped_sanitized.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\ntest_imgs/windows10_snipping_tool_2.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\nSaving sanitized file as test_imgs/windows10_snipping_tool_3_cropped_sanitized.jpg\ntest_imgs/windows10_snipping_tool_3.jpg has no trailing bytes or original EOI marker!\nThis file is not affected by acropalypse.\nSaving sanitized file as test_imgs/windows11_1_cropped_sanitized.png\ntest_imgs/windows11_1_cropped_sanitized.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\ntest_imgs/windows11_1.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\nSaving sanitized file as test_imgs/windows11_2_cropped_sanitized.png\ntest_imgs/windows11_2_cropped_sanitized.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\ntest_imgs/windows11_2.png has no trailing bytes or original IEND chunk!\nThis file is not affected by acropalypse.\nSaving sanitized file as test_imgs/windows11_3_cropped_sanitized.jpg\ntest_imgs/windows11_3.jpg has no trailing bytes or original EOI marker!\nThis file is not affected by acropalypse.\n```\n\nThis script removes the original data after the end of the cropped file making it impossible to recover the original content:\n\n![Hex comparison between sanitized and vulnerable image.](/Screenshot%202023-03-22%20121216.png)\n\n```\n$ ls -la test_imgs/\ntotal 1472\ndrwxrwxr-x 2 octa octa   4096 mar 23 15:08 .\ndrwxrwxr-x 4 octa octa   4096 mar 22 16:14 ..\n-rw-rw-r-- 1 octa octa  45077 mar 22 09:44 windows10_snipping_tool_1_cropped.png\n-rw-rw-r-- 1 octa octa   6886 mar 23 15:08 windows10_snipping_tool_1_cropped_sanitized.png\n-rw-rw-r-- 1 octa octa  45077 mar 22 09:43 windows10_snipping_tool_1.png\n-rw-rw-r-- 1 octa octa  34484 mar 22 09:44 windows10_snipping_tool_2_cropped.png\n-rw-rw-r-- 1 octa octa   5065 mar 23 15:08 windows10_snipping_tool_2_cropped_sanitized.png\n-rw-rw-r-- 1 octa octa  34484 mar 22 09:44 windows10_snipping_tool_2.png\n-rw-rw-r-- 1 octa octa 226987 mar 23 10:18 windows10_snipping_tool_3_cropped.jpg\n-rw-rw-r-- 1 octa octa 108791 mar 23 15:08 windows10_snipping_tool_3_cropped_sanitized.jpg\n-rw-rw-r-- 1 octa octa 226987 mar 23 10:18 windows10_snipping_tool_3.jpg\n-rw-rw-r-- 1 octa octa 195988 mar 22 11:18 windows11_1_cropped.png\n-rw-rw-r-- 1 octa octa   5183 mar 23 15:08 windows11_1_cropped_sanitized.png\n-rw-rw-r-- 1 octa octa 195988 mar 22 11:16 windows11_1.png\n-rw-rw-r-- 1 octa octa 109834 mar 22 11:26 windows11_2_cropped.png\n-rw-rw-r-- 1 octa octa   1365 mar 23 15:08 windows11_2_cropped_sanitized.png\n-rw-rw-r-- 1 octa octa 109834 mar 22 11:24 windows11_2.png\n-rw-rw-r-- 1 octa octa  46318 mar 23 15:02 windows11_3_cropped.jpg\n-rw-rw-r-- 1 octa octa  13218 mar 23 15:08 windows11_3_cropped_sanitized.jpg\n-rw-rw-r-- 1 octa octa  46318 mar 23 15:02 windows11_3.jpg\n```\n\nThat is why the size of the sanitized images is much smaller and the cropped images have the same size as the original ones.\n\nThese scripts are based on https://gist.github.com/DavidBuchanan314/93de9d07f7fab494bcdf17c2bd6cef02\n\nIf you want to try to recover the original screenshots use https://acropalypse.app","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfobyte%2Fcve-2023-21036","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finfobyte%2Fcve-2023-21036","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfobyte%2Fcve-2023-21036/lists"}