VU#580079: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration

Publisher excerpt From CERT/CC Vulnerability Notes

Overview Multiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security policies. Collectively referred to as ImageTragick2, these issues arise when ImageMagick processes attacker-controlled SVG or PostScript content using dangerous coders or delegates permitted by its default or application-supplied configuration. An attacker who can upload an image, or otherwise cause an application to process crafted image content, may be able to read or write files accessible to the ImageMagick process. In some deployments, these capabilities may be chained to achieve arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected application and host. Description ImageMagick is a widely used open-source image-processing suite. Web and content-management applications, including Ruby on Rails, WordPress, MediaWiki, ownCloud Classic, and Redmine, may use ImageMagick for operations such as thumbnail generation, cropping, conversion, and transformation. ImageMagick is also commonly included in containerized AI image-processing pipelines. It may operate before inference to normalize or transform inputs, or after inference to convert and prepare generated output. In these environments, images may originate not only from direct uploads but also from URLs, automated agents, datasets, model outputs, or other upstream services. Two vulnerability variants have been identified: Coder invocation through SVG (MSL injection) ImageMagick's SVG processing can allow a crafted SVG <image> element to invoke a dangerous coder through its xlink:href value, for example, by referencing an MSL: resource. ImageMagick may then interpret the referenced content as a Magick Scripting Language (MSL) script. The script can invoke additional image readers and direct attacker-controlled image data to selected filesystem paths, enabling unauthorized file access. Exploitation depends on the internal SVG coder and the required dangerous coders being available to the ImageMagick process. Ghostscript invocation through content detection ImageMagick's content-based format detection may identify crafted input as PostScript and invoke Ghostscript, a separate interpreter used by ImageMagick to handle PostScript, EPS, and PDF, even when the filename or declared type suggests another format. Although Ghostscript is invoked with -dSAFER, the observed configuration permits file access within /tmp. A crafted PostScript file may therefore read or write data in that directory. This can affect applications that use shared temporary storage for uploaded files, processing artifacts, sessions, or other security-sensitive data. These issues highlight an important aspect of ImageMagick's security model: Behavior that can be restricted through a custom security policy is treated as a configuration issue, not a vulnerability in ImageMagick itself. Applications and distributions…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.