In the ever-evolving realm of cybersecurity, staying ahead of potential threats is crucial. Today, we spotlight a significant vulnerability in ImageMagick, a popular software suite for creating, editing, and converting bitmap images. The early warning technology that powers Armis Centrix™ for Actionable Threat Intelligence uncovered that threat actors were using this vulnerability, known as CVE-2016-3714 or “ImageTragick.” We discovered this vulnerability was being exploited in the wild five years before it became widely recognized.
What is CVE-2016-3714?
CVE-2016-3714 is a critical vulnerability in ImageMagick that allows remote code execution due to insufficient input filtering. This flaw exists in various coders within ImageMagick versions 6.9.3-10 and earlier, and 7.x versions before 7.0.1-1.
These vulnerabilities allow attackers to execute arbitrary code through shell metacharacters embedded in a crafted image. This can lead to severe consequences, especially if exploited in environments where ImageMagick processes untrusted input, such as web servers.
The affected coders include:
- EPHEMERAL
- HTTPS
- MVG
- MSL
- TEXT
- SHOW
- WIN
- PLT
How Does the Vulnerability Work?
The root of the problem lies in ImageMagick’s delegate functionality, which enables the software to process files using external libraries. This feature uses a system call with a command string from the configuration file `delegates.xml`, incorporating various parameters like input, output, and filenames.
Due to insufficient filtering of the `%M` parameter, attackers can inject shell commands. For example, one of the default delegate commands for handling HTTPS requests is:
"wget" -q -O "%o" "https:%M"Here, `%M` represents the actual link from the input. If wget or curl is installed, it is possible to pass a crafted value such as:
"https://example.com | ls -la"This injection allows the execution of arbitrary shell commands, posing a severe security risk.
The Discovery by Armis Centrix™
The technology that powers Armis Centrix™ for Actionable Threat Intelligence identified this vulnerability long before it became widely acknowledged. The proactive approach, including AI-driven intelligence and honeypot detection, showcases the importance of continuous monitoring and early warning threat detection capabilities in identifying potential security risks.
The Impact of CVE-2016-3714
Once an attacker successfully exploits this vulnerability, they can execute arbitrary commands on the system running ImageMagick. This has widespread implications, especially for web servers that process uploaded images. The ability to run unauthorized commands can lead to data breaches, unauthorized access, and further exploitation of the compromised system.
Mitigation and Protection
To mitigate this vulnerability, users should update to ImageMagick version 6.9.3-10 or 7.0.1-1 immediately. Additionally, the following steps can help protect against potential exploitation:
1. Verify File Integrity:
Ensure that all image files begin with the expected “magic bytes” corresponding to supported file types before processing them with ImageMagick.
2. Disable Vulnerable Coders:
Use a policy file to disable vulnerable ImageMagick coders. For example, add the following entries to the `policy.xml` file:
<policy domain="coder" rights="none" pattern="EPHEMERAL"/>
<policy domain="coder" rights="none" pattern="HTTPS"/>
<policy domain="coder" rights="none" pattern="MVG"/>
<policy domain="coder" rights="none" pattern="MSL"/>
<policy domain="coder" rights="none" pattern="TEXT"/>
<policy domain="coder" rights="none" pattern="SHOW"/>
<policy domain="coder" rights="none" pattern="WIN"/>
<policy domain="coder" rights="none" pattern="PLT"/>3. Remove HTTPS Support:
Eliminate support for HTTPS by deleting it from the `delegates.xml` configuration file.
Conclusion
The discovery of CVE-2016-3714 by the technology that powers Armis Centrix™ for Actionable Threat Intelligence underscores the significance of early warning threat intelligence in preemptively identifying and mitigating cybersecurity risks. By staying ahead of potential vulnerabilities and threats, organizations can better protect their systems and sensitive data from malicious actors.
For more detailed information and updates, refer to these resources:
Stay vigilant and ensure your systems are up-to-date to defend against evolving cybersecurity threats.
Armis Centrix™ for Actionable Threat Intelligence is the proactive cybersecurity solution designed to empower organizations with early warning intelligence to anticipate and mitigate cyber threats effectively. By leveraging AI-driven actionable threat intelligence, Armis Centrix™ provides insights into potential threats, allowing organizations to understand their impact and take preemptive action.
Interested in learning more about Armis Centrix™ for Actionable Threat Intelligence? Sign up for a demo today!