{"id":4163,"date":"2016-05-05T04:02:49","date_gmt":"2016-05-04T20:02:49","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4163"},"modified":"2016-05-05T04:03:17","modified_gmt":"2016-05-04T20:03:17","slug":"multiple-serious-imagemagick-zero-day-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/05\/multiple-serious-imagemagick-zero-day-vulnerabilities\/","title":{"rendered":"Serious ImageMagick Zero-Day Vulnerabilities &#8211; ImageTragick?"},"content":{"rendered":"<p>So another vulnerability with a name and a logo &#8211; ImageTragick? At least this time it&#8217;s pretty dangerous, a bunch of ImageMagick Zero-Day vulnerabilities have been announced including one that can leave you susceptible to remote code execution. <\/p>\n<p>It&#8217;s pretty widely used software too and very public, if you use an app online that lets you upload images and they get cropped\/resized then it&#8217;s probably using ImageMagick or something similar on the back-end (PHP often uses GD).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/05\/ImageTragick-640x492.png\" alt=\"Serious ImageMagick Zero-Day Vulnerabilities - ImageTragick?\" width=\"640\" height=\"492\" class=\"aligncenter size-medium wp-image-4164\" \/><\/p>\n<p>I know some organisations that use it in their Ruby apps to deal with user avatar uploads, and they will be very open to this channel of ownage. Of course if you&#8217;re already smart and using a third party service to do it like Cloudinary or ImgIX &#8211; you are safe.<\/p>\n<blockquote><p>A wildly popular software tool used by websites to process people&#8217;s photos can be exploited to execute malicious code on servers and leak server-side files.<\/p>\n<p>Security bugs in the software are apparently being exploited in the wild right now to compromise at-risk systems. Patches to address the vulnerabilities are available in the latest source code \u2013 but are incomplete and have not been officially released, we&#8217;re told.<\/p>\n<p>Whenever you upload a profile photo, a gallery of snaps, or a silly meme to a website, there&#8217;s an extremely high chance that the site is using ImageMagick, an open-source collection of image processing tools, to resize, crop and tweak the pictures.<\/p>\n<p>By feeding booby-trapped data \u2013 such as a poisoned selfie \u2013 to web services using ImageMagick, it may be possible to execute malicious code on the website&#8217;s server. From there hackers can start infiltrating the system to steal secrets, snoop on people&#8217;s accounts, and so on.<\/p><\/blockquote>\n<p> <em>Source:<\/em> <a href=\"http:\/\/www.theregister.co.uk\/2016\/05\/03\/imagemagick\/\">The Register<\/a><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>The exploit is in use in the wild as it&#8217;s fairly trivial and current patches are incomplete. It seems like the details leaked out before the proper patches could be developed, tested and rolled out &#8211; they are expected to come this weekend though.<\/p>\n<p>The flaw itself somehow seems to be related to these <a href=\"https:\/\/github.com\/ImageMagick\/ImageMagick\/blob\/e93e339c0a44cec16c08d78241f7aa3754485004\/www\/source\/delegates.xml#L62\">insecure delegates<\/a> used by ImageMagick.<\/p>\n<h3>How to Protect against it<\/h3>\n<p>1. Verify that all image files begin with the expected &#8220;magic bytes&#8221; corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)<br \/>\n2. Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in \u201c\/etc\/ImageMagick\u201d. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.<\/p>\n<p>An example policy.xml: <\/p>\n<pre><policymap>\r\n  <policy domain=\"coder\" rights=\"none\" pattern=\"EPHEMERAL\" \/>\r\n  <policy domain=\"coder\" rights=\"none\" pattern=\"URL\" \/>\r\n  <policy domain=\"coder\" rights=\"none\" pattern=\"HTTPS\" \/>\r\n  <policy domain=\"coder\" rights=\"none\" pattern=\"MVG\" \/>\r\n  <policy domain=\"coder\" rights=\"none\" pattern=\"MSL\" \/>\r\n<\/policymap><\/pre>\n<p>Do note, this is not a complete protection and you need to apply the patches as soon as they are released.<\/p>\n<p>This has been assigned &#8211; CVE-2016\u20133714 and if you want to read a more technical look at the issues, read this thread &#8211; <a href=\"http:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/03\/18\">Re: ImageMagick Is On Fire &#8212; CVE-2016-3714<\/a> and this &#8211; <a href=\"https:\/\/news.ycombinator.com\/item?id=11623694\">Remote code execution vulnerability in ImageMagick<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So another vulnerability with a name and a logo &#8211; ImageTragick? At least this time it&#8217;s pretty dangerous, a bunch of ImageMagick Zero-Day vulnerabilities have been announced including one that can leave you susceptible to remote code execution. It&#8217;s pretty widely used software too and very public, if you use an app online that lets [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So another vulnerability with a name and a logo? And pretty dangerous this time, a bunch of ImageMagick Zero-Day vulnerabilities have been announced.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10,15],"tags":[],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4163"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4163"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4163\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}