CVE-2022-44268 PoC — ImageMagick 安全漏洞

Source

https://github.com/Baikuya/CVE-2022-44268-PoC

Associated Vulnerability

Title: ImageMagick 安全漏洞 (CVE-2022-44268)
Description:ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

Description

CVE-2022-44268 PoC

Readme

# CVE-2022-44268-PoC

This repository includes a test file for CVE-2022-44268 ImageMagick Arbitrary File Read.


## Testing

1. Upload the `pngout.png` into a Webapplication
2. Check if the image can be cropped, cut or edited in any way
3. Download the edited image
4. Use `identify -verbose edit_image.png` to see if `Raw profile type:` has some value
5. If the applciation is vulnerable you will see some bytes which contain the `/etc/passwd` for the application host

## Legal notice

Only use this for testing and legal purpose

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →