Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?

Outsmart Malicious Hackers


So another vulnerability with a name and a logo – ImageTragick? At least this time it’s pretty dangerous, a bunch of ImageMagick Zero-Day vulnerabilities have been announced including one that can leave you susceptible to remote code execution.

It’s pretty widely used software too and very public, if you use an app online that lets you upload images and they get cropped/resized then it’s probably using ImageMagick or something similar on the back-end (PHP often uses GD).

Serious ImageMagick Zero-Day Vulnerabilities - ImageTragick?

I know some organisations that use it in their Ruby apps to deal with user avatar uploads, and they will be very open to this channel of ownage. Of course if you’re already smart and using a third party service to do it like Cloudinary or ImgIX – you are safe.

A wildly popular software tool used by websites to process people’s photos can be exploited to execute malicious code on servers and leak server-side files.

Security bugs in the software are apparently being exploited in the wild right now to compromise at-risk systems. Patches to address the vulnerabilities are available in the latest source code – but are incomplete and have not been officially released, we’re told.

Whenever you upload a profile photo, a gallery of snaps, or a silly meme to a website, there’s an extremely high chance that the site is using ImageMagick, an open-source collection of image processing tools, to resize, crop and tweak the pictures.

By feeding booby-trapped data – such as a poisoned selfie – to web services using ImageMagick, it may be possible to execute malicious code on the website’s server. From there hackers can start infiltrating the system to steal secrets, snoop on people’s accounts, and so on.

Source: The Register


The exploit is in use in the wild as it’s fairly trivial and current patches are incomplete. It seems like the details leaked out before the proper patches could be developed, tested and rolled out – they are expected to come this weekend though.

The flaw itself somehow seems to be related to these insecure delegates used by ImageMagick.

How to Protect against it

1. Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
2. Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.

An example policy.xml:

Do note, this is not a complete protection and you need to apply the patches as soon as they are released.

This has been assigned – CVE-2016–3714 and if you want to read a more technical look at the issues, read this thread – Re: ImageMagick Is On Fire — CVE-2016-3714 and this – Remote code execution vulnerability in ImageMagick.

Learn about Exploits/Vulnerabilities



Posted in: Exploits/Vulnerabilities, Web Hacking

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


Comments are closed.