Security Policy Bypass in ImageMagick

Executive Summary

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 have a security policy bypass vulnerability. An attacker can provide input to ImageMagick to evade configured security policy restrictions, allowing operations the policy was meant to block. This issue stems from an incomplete fix for a prior policy bypass reported in GHSA-jjp4-3fwf-393j.

Useful 0 Not Useful 0

Detection Guidance

Check ImageMagick version using 'convert --version' or 'magick --version'. If the version is below 6.9.13-58 or 7.1.2-32, the system is vulnerable. Review ImageMagick policy files for unexpected configurations.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers with access to provide input to ImageMagick to bypass security policies. This could enable unauthorized operations that the policy was designed to prevent, though the impact is limited due to low severity and high attack complexity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 6.9.13-58 or later for 6.x branch, or 7.1.2-32 or later for 7.x branch. Review and update security policies to ensure they block intended operations.

Useful 0 Not Useful 0