CVE-2022-24720: Improper Input Validation in image_processing
imageprocessing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the #apply method from imageprocessing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of imageprocessing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24720?
CVE-2022-24720 has a moderate severity level due to its potential for remote code execution through unsanitized input.
How do I fix CVE-2022-24720?
To fix CVE-2022-24720, upgrade to version 1.12.2 or later of the image_processing library.
Which versions of ruby-image-processing are affected by CVE-2022-24720?
Versions prior to 1.12.2 of the ruby-image-processing library are affected by CVE-2022-24720.
What is the impact of exploiting CVE-2022-24720?
Exploiting CVE-2022-24720 allows attackers to execute arbitrary shell commands on the server.
Could my application be vulnerable to CVE-2022-24720?
If your application uses an affected version of ruby-image-processing before 1.12.2, it could be vulnerable to CVE-2022-24720.