{"id":184253,"date":"2026-11-13T17:41:21","date_gmt":"2026-11-13T15:41:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataki-na-prilozheniya-ispolzuyushhie-imagemagick-v-konfiguraczii-po-umolchaniyu"},"modified":"2026-11-13T17:41:42","modified_gmt":"2026-11-13T15:41:42","slug":"attacks-on-applications-using-imagemagick-with-default-settings","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings","title":{"rendered":"Uzbrukumi uz lietojumprogramm\u0101m, kas izmanto ImageMagick noklus\u0113juma konfigur\u0101cij\u0101","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Koordin\u0101cijas centrs CERT (datoru reakcijas grupa \u0101rk\u0101rtas situ\u0101cij\u0101m) public\u0113jis br\u012bdin\u0101jumu par konstat\u0113taj\u0101m ievainojam\u012bb\u0101m, kas ietekm\u0113 lietotnes un vietnes, kas izmanto bibliot\u0113ku ImageMagick, noklus\u0113juma konfigur\u0101cij\u0101, att\u0113lu apstr\u0101d\u0113 vai p\u0101rveido\u0161an\u0101. Veiksm\u012bga uzbrukuma gad\u012bjum\u0101 uzbruc\u0113js var\u0113tu las\u012bt un rakst\u012bt failus saska\u0146\u0101 ar piek\u013cuves ties\u012bb\u0101m, ar kur\u0101m darbojas ImageMagick. Ievainojam\u012bb\u0101m pie\u0161\u0137irts kods ImageTragick2, l\u012bdz\u012bgi probl\u0113mai, kas tika konstat\u0113ta 2016. gad\u0101. <\/p>\n<p>P\u0113d\u0113jo divu m\u0113ne\u0161u laik\u0101 ImageMagick ir nov\u0113rsti apm\u0113ram simts ievainojam\u012bbu, ta\u010du probl\u0113mas, par kur\u0101m br\u012bdina CERT, ir saist\u012btas nevis ar k\u013c\u016bd\u0101m ImageMagick kod\u0101, bet gan ar noklus\u0113juma iestat\u012bjumiem, kas at\u013cauj izsaukt \u0101r\u0113jus apstr\u0101d\u0101t\u0101jus SVG un PostScript form\u0101tiem.<br \/>\nApstr\u0101d\u0101t\u0101js ImageMagick tiek izv\u0113l\u0113ts atkar\u012bb\u0101 no satura, nevis faila papla\u0161in\u0101juma, t\u0101p\u0113c, ja lietotne filtr\u0113 aug\u0161upiel\u0101des p\u0113c papla\u0161in\u0101juma, uzbruc\u0113js var nodot datus SVG vai PostScript form\u0101, piem\u0113ram, k\u0101 failus ar JPEG vai PNG papla\u0161in\u0101jumu. <\/p>\n<p>Iesp\u0113ja izmantot ievainojam\u012bbu ir apstiprin\u0101ta Ruby on Rails un WordPress lietotn\u0113s, bet nav izsl\u0113gti ar\u012b citi projekti, kas izmanto ImageMagick att\u0113lu konvert\u0113\u0161anai, apgrie\u0161anai un s\u012bkt\u0113lu veido\u0161anai, piem\u0113ram, MediaWiki, ownCloud Classic un Redmine. Probl\u0113ma attiecas ar\u012b uz AI r\u012bkiem, kas izmanto ImageMagick att\u0113lu apstr\u0101d\u0113.<\/p>\n<p>Tiek sniegti divi uzbrukumu scen\u0101riji:<\/p>\n<ul>\n<li class=\"l\"> Satur\u0113ta att\u0113la apstr\u0101des izsaukums MSL (Magick Scripting Language) valod\u0101, nos\u016btot \u012bpa\u0161i izstr\u0101d\u0101tu SVG att\u0113lu, kur\u0101 elements  satur saiti 'xlink:href' uz resursu, kas izmanto protokolu 'MSL:'. ImageMagick interprete \u0161o resursu saturu k\u0101 MSL skriptu, \u013caujot taj\u0101 veikt failu rakst\u012b\u0161anas un las\u012b\u0161anas oper\u0101cijas. Papildus MSL l\u012bdz\u012bgu triku ar SVG var izmantot ar\u012b citu b\u012bstamu satura veidu apstr\u0101dei.\n<li class=\"l\"> Ghostscript interpretera izsaukums PostScript form\u0101ta satura apstr\u0101dei. Ghostscript tiek palaists ar ' -dSAFER' karogu, kas neierobe\u017eo piek\u013cuvi katalogam \/tmp, \u013caujot uzbruc\u0113jam las\u012bt vai main\u012bt failus \u0161aj\u0101 katalog\u0101 (piem\u0113ram, lietotnes var pagaid\u0101m saglab\u0101t datus un aug\u0161upiel\u0101d\u0113t failus \u0161aj\u0101 viet\u0101). Ghostscript regul\u0101ri atrod ievainojam\u012bbas, kas piln\u012bb\u0101 apiet ' -dSAFER' ierobe\u017eojumus (p\u0113d\u0113j\u0101 \u0161\u0101du ievainojam\u012bbu atkl\u0101ja 10. novembr\u012b).\n<\/ul>\n<p>Lai blo\u0137\u0113tu ievainojam\u012bbas, nepietiek vien ar ImageMagick atjaunin\u0101\u0161anu, nepiecie\u0161ams main\u012bt iestat\u012bjumus fail\u0101 \/etc\/ImageMagick\/policy.xml, kur\u0101 j\u0101atst\u0101j tikai vissvar\u012bg\u0101kie form\u0101ti un oper\u0101cijas vai vismaz j\u0101aizliedz \u0101r\u0113jo apstr\u0101d\u0101t\u0101ju izsauk\u0161ana form\u0101tiem MSL, MVG, PS, EPS un PDF. Turkl\u0101t ieteicams izol\u0113t kodu, kas p\u0101rv\u0113r\u0161 tre\u0161o pu\u0161u att\u0113lus, atsevi\u0161\u0137\u0101 konteiner\u0101, p\u0101rbaud\u012bt failus ne tikai p\u0113c papla\u0161in\u0101juma, bet ar\u012b p\u0113c satura, un konfigur\u0113t ImageMagick \u017eurn\u0101lu uzraudz\u012bbu attiec\u012bb\u0101 uz av\u0101rij\u0101m un neparastu aktivit\u0101ti.<\/p>\n<p>   &lt;policy domain=&#187;coder&#187; rights=&#187;none&#187; pattern=&#187;MSL&#187;\/&gt;<br \/>\n   &lt;policy domain=&#187;delegate&#187; rights=&#187;none&#187; pattern=&#187;gs&#187;\/&gt;<br \/>\n   &lt;policy domain=&#187;coder&#187; rights=&#187;none&#187; pattern=&#187;{PS,PS2,PS3,EPS,EPS2,EPS3,EPI,EPSF,EPSI,EPT,EPT2,EPT3,PDF,AI,EPDF,PDFA,POCKETMOD,XPS,PCL}&#187;\/&gt;<br \/>\n<br \/>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66679\">opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 ImageMagick \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u043b\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. \u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f ImageMagick. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f ImageTragick2, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184253","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 ImageMagick \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 ImageMagick \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 ImageMagick \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-13T15:41:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-13T15:41:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uzbrukumi lietotn\u0113m, kas izmanto ImageMagick noklus\u0113juma konfigur\u0101cij\u0101 | ProHoster","description":"CERT koordin\u0101cijas centrs (datoru \u0101rk\u0101rtas situ\u0101ciju rea\u0123\u0113\u0161anas grupa) ir public\u0113jis br\u012bdin\u0101jumu par ievainojam\u012bbu atkl\u0101\u0161anu, kas skar lietotnes un t\u012bmek\u013ca vietnes, kas izmanto ImageMagick bibliot\u0113ku.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 ImageMagick \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u0430\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 ImageMagick \u0432.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/attacks-on-applications-using-imagemagick-with-default-settings","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-13T15:41:21+00:00","article:modified_time":"2026-11-13T15:41:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=184253"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184253\/revisions"}],"predecessor-version":[{"id":184254,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184253\/revisions\/184254"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=184253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=184253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=184253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}