CVE-2023-34152 PoC — ImageMagick 操作系统命令注入漏洞

Source

https://github.com/SudoIndividual/CVE-2023-34152

Associated Vulnerability

Title: ImageMagick 操作系统命令注入漏洞 (CVE-2023-34152)
Description:A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.

Description

POC for ImageMagick 6.9.6-4. This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152.

Readme

# CVE-2023-34152
RCE vulnerability affecting ImageMagick 6.9.6-4. This vulnerability allows the attacker to execute commands on the victim system. Thus, allowing for Remote Command Execution.

This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152.

[Vulnerability Disclosure](https://github.com/ImageMagick/ImageMagick/issues/6339)

```
Usage: python3 CVE-2023-34152.py Attacker_IP Attacker_Port
```
## Description
an aribitary code execution vulnerability (shell command injection) in OpenBlob, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will popen the remaining part of the file name. As a fix, it add a configure option --enable-pipes to specially turn on the support of pipes; and also, the invocation of SanitizeString is added before popen_utf8 the filename to suppress aribitary command execution.

However, SanitizeString only filters out characters like single quotes but not ` or ". This allows shell command injection through malformed file name.

Credits: [fullwaywang](https://github.com/fullwaywang)
## PATCH

Upgrade to version 7.1.1.10 

---

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →