IsRightsAuthorizedByName Policy Bypass in ImageMagick

Executive Summary

This vulnerability in ImageMagick versions before 7.1.2-33 and 6.9.13-58 allows local attackers to bypass security policy restrictions by creating a symbolic link pointing to a restricted path. The IsRightsAuthorizedByName policy check fails to properly account for symbolic links, enabling evasion of configured restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ImageMagick version is below 7.1.2-33 or 6.9.13-58. Run: convert --version or identify --version. If the version is outdated, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you are running a vulnerable version of ImageMagick, an attacker with local access could exploit this to bypass security policies, potentially accessing or modifying restricted files. The impact is limited to confidentiality and integrity with minimal changes to scope.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to bypass configured security policies by exploiting symbolic links, potentially enabling unauthorized access to restricted files. While not directly tied to GDPR or HIPAA, such policy bypasses could undermine compliance by allowing unauthorized data access or modification, which may violate data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update ImageMagick to version 7.1.2-33 or later for 7.x, or 6.9.13-58 or later for 6.x. Remove unnecessary write permissions for users who can create symlinks to prevent exploitation.

Useful 0 Not Useful 0