Attacks on applications using ImageMagick in the default configuration.

The CERT Coordination Center (Computer Emergency Response Team) has issued a warning about vulnerabilities affecting applications and websites using the ImageMagick library with default configuration for image processing or conversion. Successful exploitation allows an attacker to read and write files based on the access rights under which ImageMagick operates. This vulnerability has been assigned the code name ImageTragick2, akin to the issue identified in 2016.

In the last two months, around a hundred vulnerabilities have been addressed in ImageMagick, but the concerns flagged by CERT are not due to coding errors in ImageMagick but rather the default settings that permit the invocation of external handlers for SVG and PostScript formats.
The handler in ImageMagick is selected based on content rather than file extension, so if an application filters uploads at the extension level, an attacker can submit data in SVG or PostScript formats, disguised as files with JPG or PNG extensions.

The possibility of vulnerability exploitation has been confirmed in applications based on Ruby on Rails and WordPress, but it is also not ruled out in other projects utilizing ImageMagick for image conversion, cropping, and thumbnail creation, such as MediaWiki, ownCloud Classic, and Redmine. The issue also extends to AI tools that invoke ImageMagick when performing image processing tasks.

Two attack scenarios are presented:

• Invocation of a content handler in the MSL (Magick Scripting Language) through the submission of a specially crafted SVG image, where the element contains a link ‘xlink:href’ to a resource with the protocol ‘MSL:’. ImageMagick interprets the content of this resource as an MSL script, allowing file read and write operations in MSL scripts. In addition to MSL, a similar trick with SVG can be used to process other dangerous types of content.
• Call to the Ghostscript interpreter for processing content in PostScript format. Ghostscript is launched with the flag "-dSAFER", which does not restrict access to the /tmp directory, allowing an attacker to read or modify files in that directory (for example, applications can temporarily store session data and uploaded files in /tmp). Vulnerabilities that allow for complete circumvention of the "-dSAFER" restriction are regularly found in Ghostscript (the latest such vulnerability was disclosed on November 10).

Simply updating ImageMagick is not enough to block vulnerabilities; changes must be made in the file /etc/ImageMagick/policy.xml, in which only support for the most essential formats and operations should be retained, or at least external handlers for MSL, MVG, PS, EPS, and PDF formats should be prohibited. Additionally, it is recommended to isolate code for converting third-party images in a separate container, verify files not only by extension but also by content, and set up monitoring of ImageMagick logs for failures and unusual activity.

<policy domain=»coder» rights=»none» pattern=»MSL»/>
<policy domain=»delegate» rights=»none» pattern=»gs»/>
<policy domain=»coder» rights=»none» pattern=»{PS,PS2,PS3,EPS,EPS2,EPS3,EPI,EPSF,EPSI,EPT,EPT2,EPT3,PDF,AI,EPDF,PDFA,POCKETMOD,XPS,PCL}»/>

Source: opennet.ru