ImageMagick vulnerabilities place countless websites at risk, active exploitation confirmed

Tuesday afternoon, Slack security engineer Ryan Huber posted a brief warning on Medium surrounding vulnerabilities in ImageMagick, an image manipulation suite installed on millions of web servers.

These flaws, which are being actively exploited by criminals, leave websites vulnerable to a complete takeover.

“There is some irony in disclosing vulnerabilities affecting an image processing package and not giving them logos, but here we are…,” Huber wrote, softening the blow some.

Humor aside, the issue is serious. Millions of web servers have ImageMagick compiled along with PHP, but the vulnerability is also present on servers where the library is compiled with Ruby (rmagick and paperclip) and NodeJS’s ImageMagick.

“Attackers are exploiting the issue by uploading malicious images to web applications that use the ImageMagick library to process them. There is a ton of attack surface,” said security researcher and Metasploit founder HD Moore.

On Wednesday, Moore said, Metasploit modules for the vulnerabilities will be released. It should be noted that Rapid7 was not involved in the discovery or disclosure of the ImageMagick problems.

In all, it’s expected that four CVEs will be issued around this flaw. For now, the only known identifier is CVE-2016–3714, and if a name has to be associated with it, Huber suggested ImageTragick. Additional details on the vulnerability will be posted later to the ImageTragick domain.

There are patches coming, but the disclosure came first because the flaws are being actively exploited. Until they’re released, administrators can mitigate the problem by editing policy.xml. Details were posted on the ImageMagick forum Tuesday afternoon.

Another possible mitigation is to verify that images start with the correct “magic bytes” or signatures, before being passed to ImageMagick for processing. A full list of “magic bytes” for most common file types is available on Wikipedia.

According to Huber, the mitigations are effective against all exploit samples observed so far, but there is no guarantee they will eliminate all attack vectors.