ImageMagick Policy Bypass via Coder Domain Evasion

Executive Summary

This vulnerability in ImageMagick before versions 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses 'coder' instead of 'module' as its domain. An attacker can exploit this by providing a crafted image to bypass intended format restrictions, enabling ImageMagick to process blocked file formats.

Useful 0 Not Useful 0

Detection Guidance

Check ImageMagick version with 'convert --version' or 'magick --version'. If running versions before 6.9.13-56 or 7.x before 7.1.2-31, the system is vulnerable. Review policy files for 'coder' domain usage instead of 'module'.

Useful 0 Not Useful 0

Impact Analysis

This flaw could allow unauthorized processing of restricted image formats, potentially leading to further security risks such as data exfiltration or execution of malicious code. The attack requires local access but has low complexity and does not need user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized processing of restricted image formats, which could lead to exposure of sensitive data. For GDPR, this may result in unauthorized data processing or disclosure, violating principles of data protection. For HIPAA, it could permit access to protected health information without proper authorization, compromising patient privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to patched versions 6.9.13-56 or 7.1.2-31 or later. Replace any policies using 'coder' domain with 'module' domain to enforce intended restrictions.

Useful 0 Not Useful 0