{"id":184253,"date":"2026-11-13T17:41:21","date_gmt":"2026-11-13T15:41:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataki-na-prilozheniya-ispolzuyushhie-imagemagick-v-konfiguraczii-po-umolchaniyu"},"modified":"2026-11-13T17:41:42","modified_gmt":"2026-11-13T15:41:42","slug":"attacks-on-applications-using-imagemagick-with-default-settings","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings","title":{"rendered":"Attacks on applications using ImageMagick in the default configuration.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The CERT Coordination Center (Computer Emergency Response Team) has issued a warning about vulnerabilities affecting applications and websites using the ImageMagick library with default configuration for image processing or conversion. Successful exploitation allows an attacker to read and write files based on the access rights under which ImageMagick operates. This vulnerability has been assigned the code name ImageTragick2, akin to the issue identified in 2016. <\/p>\n
In the last two months, around a hundred vulnerabilities have been addressed in ImageMagick, but the concerns flagged by CERT are not due to coding errors in ImageMagick but rather the default settings that permit the invocation of external handlers for SVG and PostScript formats. \nThe handler in ImageMagick is selected based on content rather than file extension, so if an application filters uploads at the extension level, an attacker can submit data in SVG or PostScript formats, disguised as files with JPG or PNG extensions. <\/p>\n
The possibility of vulnerability exploitation has been confirmed in applications based on Ruby on Rails and WordPress, but it is also not ruled out in other projects utilizing ImageMagick for image conversion, cropping, and thumbnail creation, such as MediaWiki, ownCloud Classic, and Redmine. The issue also extends to AI tools that invoke ImageMagick when performing image processing tasks.<\/p>\n
Two attack scenarios are presented:<\/p>\n
\n
Calling a content handler in MSL (Magick Scripting Language) by passing a specially formatted SVG image where the element contains a link \u2018xlink:href\u2019 to a resource with the protocol \u2018MSL:\u2019. ImageMagick interprets the content of this resource as a MSL script, allowing file read and write operations in MSL scripts. Besides MSL, a similar trick with SVG can be used to process other dangerous types of content.\n
Invoking the Ghostscript interpreter to process content in PostScript format. Ghostscript is launched with the flag \u2018-dSAFER\u2019, which does not restrict access to the \/tmp directory, allowing an attacker to read or modify files in this directory (for instance, applications may temporarily store session data and uploaded files in \/tmp). Vulnerabilities are regularly found in Ghostscript that allow complete bypassing of the \u2018-dSAFER\u2019 restriction (the latest vulnerability was disclosed on November 10).\n<\/ul>\n
Simply updating ImageMagick is not enough to block vulnerabilities; changes must be made in the file \/etc\/ImageMagick\/policy.xml, in which only support for the most essential formats and operations should be retained, or at least external handlers for MSL, MVG, PS, EPS, and PDF formats should be prohibited. Additionally, it is recommended to isolate code for converting third-party images in a separate container, verify files not only by extension but also by content, and set up monitoring of ImageMagick logs for failures and unusual activity.<\/p>\n