Summary

ImageMagick's MSL coder lets an XML document specify the filename of an image to read, and passes that attacker-controllable value to ImageMagick's general file-opening routine. When processing, this leads to OS Command injection that can execute a full RCE attack.

Details

In builds compiled with the optional --enable-pipes feature, that routine treats any filename beginning with a | character as a shell command and runs it through popen() so an MSL document containing :

<read filename="|command" />

The result is arbitrary OS command execution reachable whenever three conditions hold together:

• the build enabled pipes,
• the active security policy permits MSL reads
• and the coder selection processes MSL

Coder selection, as far as I can see is not determined by file content. But it may be controllable when processing uploaded images, for example. Because those preconditions are not ImageMagick's defaults, this is a high-impact but has some restrictions for successful execution. Ultimaetly, some pre-requisites need to be in place for the execution to flow from zero to hero.

Untrusted input enters at MSLStartElement(), the intended neutralisation in SanitizeString() is ineffective, and command execution occurs at the sink OpenBlob() via popen_utf8(). If all the pre-requisites are met, and the attack vector facilitates the chosing of the MSL coder to process the MSL data, then the exploitation will allow full remote code execution with the same privileges of the process invoking the MSL functionality of image magick.

The main problem are localised to:

• MSLStartElement() (msl.c)
• OpenBlob() (blob.c)
• SanitizeString()

      blob_info->file_info.file=(FILE *) popen_utf8(sanitize_command,fileMode);

The full flow:

MSLStartElement → ReadImage → SetImageInfo → OpenBlob → SanitizeString (ineffective) → popen_utf8.

PoC

<?xml version="1.0" encoding="UTF-8"?>
<image>
<read filename="|touch /tmp/someFile_new.txt" />
</image>

$>./bin/magick identify MSL:payload.msl***

As noted, this requires --enable-pipes to be turned on at compile time.

Impact

The impact is RCE on the system that uses imagemagick to process the maliciously formed MSL data.

CVE

CVE number has been requested and is pending.

Notes

Was considered an invalid report.