Hacker found a way to hack Facebook by exploiting the ImageMagick flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-3714 | Command Injection RCE in ImageMagick Image Coders (ImageTragick) ImageTragick (CVE-2016-3714) is an improper input validation flaw in ImageMagick's EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders that allows shell metacharacters embedded in a crafted image to be passed to the command shell. It is triggered whenever ImageMagick processes a malicious image file — typically when a web application converts or thumbnails user-supplied uploads or URLs. A successful attacker gains arbitrary command and code execution on the host running ImageMagick, with the privileges of that process. Anyone running affected versions of ImageMagick — before 6.9.3-10 in the 6.x line or before 7.0.1-1 in the 7.x line, including builds shipped with Ubuntu, Debian, openSUSE/Leap and SUSE Linux Enterprise Server — is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09, and EPSS places its 30-day exploitation probability at 97.5% (100th percentile), consistent with active exploitation. Do: Upgrade ImageMagick to 6.9.3-10 or later (6.x) or 7.0.1-1 or later (7.x), or apply the security updates issued by Ubuntu, Debian, openSUSE and SUSE. As an interim mitigation, disable or restrict the vulnerable coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) via ImageMagick's policy.xml and avoid passing user-controlled filenames or URLs unfiltered to ImageMagick. Prioritize auditing internet-facing services that process user-uploaded images (CMSs, forums, image pipelines), which are the typical delivery path for this flaw. | 8.4 | 97% | KEV |
| massmillions of installations worldwide (ImageMagick ships by default with Ubuntu, Debian, openSUSE and SLES and underpins image processing on a very large share… |
Full article345 words · extracted from securityaffairs.com · click to collapse
The bug hunter Andrew Leonov has described how to exploit an ImageMagick flaw to remotely execute code on a Facebook server.
The hacker Andrew Leonov (@4lemon) has described how to exploit the so-called ImageMagick vulnerability to remotely execute code on a Facebook server.
The ImageMagick flaw, tracked as CVE-2016-3714, affects the popular image manipulation software, ImageMagick. The flaw could be exploited by hackers to take over websites running the widely used image-enhancing app. The vulnerability in ImageMagick App allows attackers to run arbitrary code on the targeted web servers that rely on the app for resizing or cropping user-uploaded images.
@Facebook #ImageTragick remote code execution https://t.co/Rk3Qtax3ZD #RCE #BugBounty
— Andrew Leonov (@4lemon) January 17, 2017
The researcher has detailed in a post the attack and also provided a proof-of-concept exploit for the hack, Facebook has awarded him with the highest payoff since now, US$40,000.
“Once upon a time on Saturday in October i was testing some big service (not Facebook) when some redirect followed me on Facebook. It was a «Share on Facebook» dialog:” wrote Leonov.
https://www.facebook.com/dialog/feed?app_id=APP_ID&link=link.example.tld&picture=http%3A%2F%2Fattacker.tld%2Fexploit.png&name=news_name&caption=news_caption&description=news_descriotion&redirect_uri=http%3A%2F%2Fwww.facebook.com&ext=1476569763&hash=Aebid3vZFdh4UF1H
“Which many of you could see. If we look closer we can see that a `picture` parameter is a url. But there isn’t image url on page content like mentioned above.” added Leonov.
The expert has discovered the vulnerability after a service redirected him to the Facebook platform, initially he was he was convinced he had discovered a server-side request forgery vulnerability.
“First of all I thought about some kind of SSRF issue. But tests showed that url from this parameter requested from 31.13.97.* network by facebookexternalhit/1.1.”
After testing the application, the expert devised the following workflow:
- Gets `picture` parameter and requests it – this request is correct and not vulnerable
- Received picture passes on converter’s instance which used vulnerable ImageMagick library
The management of the flaw was perfect, the expert reported the issue to Facebook through the bug bounty program in October and the IT giant fixed it in less than three days.
[adrotate banner=”9″]
(Security Affairs – ImageMagick, Facebook)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/55419/hacking/facebook-imagemagick-flaw.html