ImageTragick

Product: ImageMagick ImageMagick
CVE: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718
Disclosed: 2016-05-03
CVSS: 8.4
Auth: pre-auth
CISA KEV: yes
Affected: ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1
Fixed: 6.9.3-10 / 7.0.1-1 (partial); restrictive policy.xml and magic-byte checks are the real fix

Summary

ImageMagick delegated some formats to external programs by building shell command lines, and it trusted file contents over extensions. An uploaded 'image' (actually MVG/SVG) could inject shell commands, so any site resizing user uploads with ImageMagick could be taken over.

Root cause

Delegate commands in delegates.xml were built with string formatting and run through system(), with insufficient escaping of the filename/URL (CVE-2016-3714). MVG and SVG files could reference url(https://...) and other pseudo-protocols, so file content controlled what reached the delegate. Sibling bugs gave SSRF (CVE-2016-3718), file deletion (ephemeral:, CVE-2016-3715), file move (msl:, CVE-2016-3716) and local file read (label:@, CVE-2016-3717).

Impact

Remote command execution on web apps that process uploaded images with ImageMagick (PHP imagick, RMagick, Paperclip, etc.).

Public PoC

push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|ls "-la)'
pop graphic-context

Source: imagetragick.com (exploit.mvg example)

Detection

Inspect uploads for MVG/SVG content (push graphic-context, viewbox, url(...)) regardless of extension. Check ImageMagick version and policy.xml. Nuclei template CVE-2016-3714.

Mitigation

Disable risky coders (EPHEMERAL, URL, HTTPS, MVG, MSL) in policy.xml, check magic bytes before processing, and upgrade.