Executive Summary
ImageMagick, a popular image processing software, has a vulnerability that allows an attacker to bypass administrator-defined policies and execute blocked programs. This vulnerability affects ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
Technical Analysis
The vulnerability is caused by incorrect parsing of delegate invocations in ImageMagick. An attacker can exploit this vulnerability by getting ImageMagick to process input that triggers a delegate invocation, allowing the execution of blocked programs defined in policy.xml. The vulnerability class is CWE-863, which involves improper access control.
How It Gets Exploited
An attacker would need to get ImageMagick to process input that triggers a delegate invocation. For example, an attacker could provide a malicious image file that, when processed by ImageMagick, would trigger a delegate invocation. This would allow the attacker to execute a blocked program defined in policy.xml. The attacker would need to have access to the system running ImageMagick and be able to provide the malicious input.
Impact Assessment
The vulnerability affects ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. An attacker could exploit this vulnerability to execute blocked programs, potentially leading to low integrity impact. The CVSS score of 3.3 indicates a low severity level.
Recommended Actions
To mitigate this vulnerability, users should update ImageMagick to version 6.9.13-58 or later, or 7.1.2-33 or later. Additionally, administrators should review their policy.xml files to ensure that blocked programs are properly defined and that the policy is correctly configured.
Sources
- National Vulnerability Database (NVD)
- ImageMagick security advisory (GHSA-528x-2384-jmxp)
- Vulncheck advisory (https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-policy-bypass-via-delegate-invocation-parsing)