CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability
A vulnerability was found in ImageMagick. Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats.
ImageMagick allows to process files with external libraries. This feature is called 'delegate'. It is implemented as a system() with command string ('command') from the config file delegates.xml with actual value for different params (input/output filenames etc). Due to insufficient %M param filtering it is possible to conduct shell command injection. One of the default delegate's command is used to handle https requests:
"wget" -q -O "%o" "https:%M"
where %M is the actual link from the input. It is possible to pass the value like https://example.com"|ls "-la and execute unexpected 'ls -la'. (wget or curl should be installed).
Other sources
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
— CISA
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.3-10 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.0.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3714?
CVE-2016-3714 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-3714?
To fix CVE-2016-3714, you should update ImageMagick to a version later than 6.9.3-9 or 7.0.1-0.
What types of systems are affected by CVE-2016-3714?
CVE-2016-3714 affects ImageMagick versions up to 6.9.3-9 and 7.0.1-0 across various operating systems including Ubuntu, Debian, and openSUSE.
What attacks can exploit CVE-2016-3714?
CVE-2016-3714 can be exploited to perform arbitrary code execution by manipulating file formats processed by ImageMagick.
How can I determine if my system is vulnerable to CVE-2016-3714?
You can determine if your system is vulnerable to CVE-2016-3714 by checking the installed version of ImageMagick against the vulnerable versions listed.