Remote Code Execution because of an image source? Is it Possible? Yes! Definitely. Here in this blog post, a Strynx team member found a variation of Remote Code Execution AKA RCE through ImageMagick which earned him a generous bounty of $5000. Amazingly, some tweaks inside the image source exfiltrated the data over DNS (also called side-channel attacks). Let’s see how was it done after a short introduction to ImageMagick.

 What is ImageMagick? ImageMagick is a free and open-source software suite for displaying, converting, and editing raster image and vector image files. It can read and write over 200 image file formats. Suprisingly ImageMagick is used by many Fortune 500 companies. ImageMagick is very popular and some plugins make it easy to use with PHP, Ruby, Node.js and other languages so it is common for websites to use it for image resizing or cropping.

#Protip: If a website uses your photo and crops them into the avatar, there may be a good chance that the website is using ImageMagick to do that.

 Coming on to vulnerabilities. Is it secured? No, you have to manually take efforts in securing them. In the year 2016, researchers discovered that it was possible to execute arbitrary code (CVE-2016-3714) by hiding it inside image files that a user uploads. That means an attacker can make a web server do its bidding by uploading an image containing code the attacker chooses. This is all denoted in the site https://imagetragick.com/ which deals on these vulnerabilities and how to mitigate them.

Vulnerabilities in Image Decoder:

ImageMagick allows processing files with external libraries. This feature is called ‘delegate’. It is implemented as a system() with command string (‘command’) from the config file delegates.xml with the actual value for different params (input/output filenames etc). Due to insufficient %M param filtering, it is possible to conduct shell command injection. The most dangerous part is ImageMagick supports several formats like svg, mvg – which allow to include external files from any supported protocol including delegates. As a result, any service, which uses ImageMagick to process user-supplied images and uses default delegates.xml / policy.xml, may be vulnerable to this issue. Some common exploits: (Code execution commands are set as bold)