CVE-2016-3714 PoC — ImageMagick 输入验证错误漏洞

Source

https://github.com/chusiang/CVE-2016-3714.ansible.role

Associated Vulnerability

Title:ImageMagick 输入验证错误漏洞 (CVE-2016-3714)
Description:The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Description

Fix ImageMagick Command Injection (CVE-2016-3714) with Ansible.

Readme

Ansible Role: CVE-2016-3714
=========

[![Build Status](https://travis-ci.org/chusiang/CVE-2016-3714.ansible.role.svg?branch=master)](https://travis-ci.org/chusiang/CVE-2016-3714.ansible.role) [![Ansible Galaxy](https://img.shields.io/badge/role-CVE--2016--3714-blue.svg)](https://galaxy.ansible.com/chusiang/CVE-2016-3714/)


Fix **ImageMagick Command Injection (CVE-2016-3714)** security issue with Ansible.

Requirements
------------

Any installed imagemagick and before v6.7.7.10 machine.

Role Variables
--------------

A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml.

    policy_path: "/etc/ImageMagick/policy.xml"
    injection_src: "/etc/passwd"
    injection_dest: "/tmp/hack.txt"

Dependencies
------------

none.

Example Playbook
----------------

Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:

    - hosts: servers
      roles:
         - { role: chusiang.CVE-2016-3714 }

License
-------

Copyright (c) chusiang from 2016 under the MIT license.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!