XML injection in ImageMagick

1) XML injection

EUVDB-ID: #VU48940

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2020-29599

CWE-ID: CWE-91 - XML Injection

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ImageMagick: 6.9.0-0 - 7.0.10-39

CPE2.3

• cpe:2.3:a:imagemagick_org:imagemagick:6.9.0-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.1-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.2-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.3-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.4-9:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.5-8:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.6.6:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.7-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.8-10:*:*:*:*:*:*:*
• cpe:2.3:a:imagemagick_org:imagemagick:6.9.9-4:*:*:*:*:*:*:*

External links

https://github.com/ImageMagick/ImageMagick/discussions/2851
https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.