ImageMagick Symlink Cleanup Flaw Allows File Overwrite

Executive Summary

This vulnerability in ImageMagick before version 7.1.2-32 involves improper handling of the MAGICK_SHRED_PASSES environment variable during delegate symlink cleanup. A local privileged user could exploit this to overwrite files with random data by manipulating symlinks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick. If it is prior to 7.1.2-32, the system is vulnerable. Run: identify -version or magick -version to check the version.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of ImageMagick, a local attacker with privileges could overwrite important files on your system with random data, potentially causing data loss or system instability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data integrity by allowing unauthorized overwriting of files with random data. While it does not directly expose sensitive data, it could lead to non-compliance with GDPR or HIPAA if critical files (e.g., logs, backups) are corrupted. Organizations relying on secure file deletion processes may fail to meet data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-32 or later. Remove unnecessary privileges for local users and avoid running ImageMagick in privileged contexts.

Useful 0 Not Useful 0