Fortbridge (Organization): news timeline & CVEs

Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers

Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.

Fortbridge demonstrated a laboratory chain in which a logged-in WordPress user with the upload_files permission uploads a crafted HEIC file that ImageMagick passes to libheif. Bug GHSA-x8r2-mggj-j6wr lets mismatched color-channel widths overflow memory and redirect a virtual call during decoder cleanup, leading to code execution in PHP-FPM. Pixels in WordPress-generated JPEGs leaked enough memory information to identify the library build and bypass randomization. The flaw affects libheif 1.18.0 through 1.23.2 and is fixed in 1.23.3; researchers reported no active exploitation campaign.

Cyber Security NewsOct 5, 15:20 UTC · 11d agoExploit / PoC2· 2 reads

Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads

A critical libheif heap overflow, fixed in 1.23.3, enabled authenticated WordPress RCE via crafted HEIC uploads.

Fortbridge disclosed GHSA-x8r2-mggj-j6wr, a critical heap-buffer overflow in libheif’s uncompressed-image decoder, fixed in libheif 1.23.3. A crafted HEIC can declare a 16-bit Cb plane and an 8-bit Cr plane so the decoder writes past the Cr allocation. On specific WordPress stacks using PHP Imagick and ImageMagick, an Author-level upload led to command execution as www-data; the chain also uses GHSA-2jg2-4ch7-h545, fixed in 1.23.2, to leak addresses. Debian shipped fixes in libheif 1.23.4-1~deb13u1. The published exploit is highly environment-specific and was not described as in-the-wild exploitation.

GBHackersOct 5, 12:38 UTC · 11d agoVulnerability4

Fortbridge

Timeline2 articles

Appears with

Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers

Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads