Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?


So another vulnerability with a name and a logo – ImageTragick? At least this time it’s pretty dangerous, a bunch of ImageMagick Zero-Day vulnerabilities have been announced including one that can leave you susceptible to remote code execution.

It’s pretty widely used software too and very public, if you use an app online that lets you upload images and they get cropped/resized then it’s probably using ImageMagick or something similar on the back-end (PHP often uses GD).

Serious ImageMagick Zero-Day Vulnerabilities - ImageTragick?

I know some organisations that use it in their Ruby apps to deal with user avatar uploads, and they will be very open to this channel of ownage. Of course if you’re already smart and using a third party service to do it like Cloudinary or ImgIX – you are safe.

A wildly popular software tool used by websites to process people’s photos can be exploited to execute malicious code on servers and leak server-side files.

Security bugs in the software are apparently being exploited in the wild right now to compromise at-risk systems. Patches to address the vulnerabilities are available in the latest source code – but are incomplete and have not been officially released, we’re told.

Whenever you upload a profile photo, a gallery of snaps, or a silly meme to a website, there’s an extremely high chance that the site is using ImageMagick, an open-source collection of image processing tools, to resize, crop and tweak the pictures.

By feeding booby-trapped data – such as a poisoned selfie – to web services using ImageMagick, it may be possible to execute malicious code on the website’s server. From there hackers can start infiltrating the system to steal secrets, snoop on people’s accounts, and so on.

Source: The Register


The exploit is in use in the wild as it’s fairly trivial and current patches are incomplete. It seems like the details leaked out before the proper patches could be developed, tested and rolled out – they are expected to come this weekend though.

The flaw itself somehow seems to be related to these insecure delegates used by ImageMagick.

How to Protect against it

1. Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
2. Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.

An example policy.xml:

Do note, this is not a complete protection and you need to apply the patches as soon as they are released.

This has been assigned – CVE-2016–3714 and if you want to read a more technical look at the issues, read this thread – Re: ImageMagick Is On Fire — CVE-2016-3714 and this – Remote code execution vulnerability in ImageMagick.

Posted in: Exploits/Vulnerabilities, Web Hacking


Latest Posts:


truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.


Comments are closed.