Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?


So another vulnerability with a name and a logo – ImageTragick? At least this time it’s pretty dangerous, a bunch of ImageMagick Zero-Day vulnerabilities have been announced including one that can leave you susceptible to remote code execution.

It’s pretty widely used software too and very public, if you use an app online that lets you upload images and they get cropped/resized then it’s probably using ImageMagick or something similar on the back-end (PHP often uses GD).

Serious ImageMagick Zero-Day Vulnerabilities - ImageTragick?

I know some organisations that use it in their Ruby apps to deal with user avatar uploads, and they will be very open to this channel of ownage. Of course if you’re already smart and using a third party service to do it like Cloudinary or ImgIX – you are safe.

A wildly popular software tool used by websites to process people’s photos can be exploited to execute malicious code on servers and leak server-side files.

Security bugs in the software are apparently being exploited in the wild right now to compromise at-risk systems. Patches to address the vulnerabilities are available in the latest source code – but are incomplete and have not been officially released, we’re told.

Whenever you upload a profile photo, a gallery of snaps, or a silly meme to a website, there’s an extremely high chance that the site is using ImageMagick, an open-source collection of image processing tools, to resize, crop and tweak the pictures.

By feeding booby-trapped data – such as a poisoned selfie – to web services using ImageMagick, it may be possible to execute malicious code on the website’s server. From there hackers can start infiltrating the system to steal secrets, snoop on people’s accounts, and so on.

Source: The Register


The exploit is in use in the wild as it’s fairly trivial and current patches are incomplete. It seems like the details leaked out before the proper patches could be developed, tested and rolled out – they are expected to come this weekend though.

The flaw itself somehow seems to be related to these insecure delegates used by ImageMagick.

How to Protect against it

1. Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
2. Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.

An example policy.xml:

Do note, this is not a complete protection and you need to apply the patches as soon as they are released.

This has been assigned – CVE-2016–3714 and if you want to read a more technical look at the issues, read this thread – Re: ImageMagick Is On Fire — CVE-2016-3714 and this – Remote code execution vulnerability in ImageMagick.

Posted in: Exploits/Vulnerabilities, Web Hacking


Latest Posts:


tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.


Comments are closed.