The CERT (Computer Emergency Response Team) Coordination Center has published an alert regarding the identification of vulnerabilities affecting applications and sites that use the library ImageMagick in the default configuration for image processing or conversion. Successful exploitation allows the attacker to read and write files to the extent permitted by the permissions under which ImageMagick is running. The vulnerabilities are codenamed ImageTragick2, similar to an issue identified in 2016.
Over the past two months, ImageMagick has fixed about hundreds of vulnerabilities, but the problems that CERT warns about are not caused by errors in the code ImageMagick, but using default settings that allow calling external handlers for SVG and PostScript formats.
The handler in ImageMagick is selected depending on the content, not the file extension, so if the application filters downloads at the extension level, an attacker can transfer data in SVG or PostScript formats, for example, under the guise of files with a JPEG or PNG extension.
The ability to exploit the vulnerability has been confirmed in applications based on Ruby on Rails and WordPress, but also not excluded in other projects using ImageMagick for conversion images, cropping and thumbnail creation, such as MediaWiki, ownCloud Classic and Redmine. The problem also affects AI tools that call ImageMagick when performing image processing tasks.
Two attack scenarios are given:
- Calling an MSL (Magick Scripting Language) content handler by passing a specially styled SVG image in which the element contains an “xlink:href” link to a resource with the “MSL:” protocol. ImageMagick interprets the contents of this resource as an MSL script, although MSL scripts allow file writes and reads. In addition to MSL, a similar trick with SVG can be used to handle other dangerous types of content.
- Calls the Ghostscript interpreter to process PostScript content. Ghostscript runs with the “-dSAFER” flag, which does not restrict access to the /tmp directory, allowing an attacker to read or modify files in that directory (for example, applications can temporarily store session data and downloaded files in /tmp). Ghostscript also regularly vulnerabilities are found that allow you to completely bypass the “-dSAFER” limitation (the last such vulnerability disclosed November 10).