ImageMagick Delegate Invocation Policy Bypass Vulnerability

Executive Summary

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a flaw where incorrect parsing of delegate invocations allows blocked executables in policy.xml to still run. An attacker can trick ImageMagick into processing input that triggers a delegate invocation, bypassing administrator-defined policies and executing the blocked program.

Useful 0 Not Useful 0

Detection Guidance

Check ImageMagick version with 'convert --version' or 'magick --version'. If using versions before 6.9.13-58 or 7.x before 7.1.2-33, the system is vulnerable. Review policy.xml for blocked executables and test delegate invocations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with access to trigger ImageMagick processing to execute unauthorized programs. It could lead to malware execution, data manipulation, or further system compromise, depending on the blocked executable's purpose. The attack requires user interaction and local access but no special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and policy enforcement, such as GDPR's data protection measures or HIPAA's security rules. Unauthorized program execution may lead to data breaches or unauthorized modifications, risking regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to versions 6.9.13-58 or later and 7.1.2-33 or later. Review and update policy.xml to ensure blocked executables cannot be invoked via delegate parsing. Monitor for unusual delegate invocations in logs.

Useful 0 Not Useful 0