ImageMagick popen_utf8命令注入 漏洞报告
Author: niubl（知道创宇404安全实验室）
Date: 2016-05-07
一、漏洞概要
i. 漏洞描述
ImageMagick是一款使用量很广的图片处理程序，很多厂商都调用了这个程序进行图片处理，包括图片的伸缩、切割、水印、格式转换等等。我发现当用户传入一个包含|竖线的文件名的时候，就有可能触发命令注入漏洞。
ii. 漏洞影响
测试：ImageMagick-7.0.1-2.tar.bz2
iii. 漏洞分析
ImageMagick在处理文件名时会调用OpenBlob()函数，在OpenBlob()函数中，代码2484行，判断文件名是否以|竖线开头，如果是，那么他会调用popoen_utf8()函数处理文件名，代码如图：
来到popoen_utf8()函数，popen_utf8()函数调用会调用popen()函数打开文件，这样就导致我们可以注入系统命令，代码如图：
iv. 漏洞利用（PHP）
在PHP禁用执行系统命令函数的时候，我们可以用他来绕过disable_funtion，PHP编写如下代码：
<?phpnew Imagick('|touch /tmp/niubl');?>使用PHP执行，结果如图：
二、修复方案
目前官方已经更新代码至 Gitlab，但最终修复版本还未发布，补丁细节可参考如下链接：
- http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb
- http://git.imagemagick.org/repos/ImageMagick/commit/4674b3e1ea87a69646a6dbac8772c45eeb20c9f0
三、漏洞时间线
2016.05.07 知道创宇404安全实验室niubl发现该漏洞
2016.05.29 国外研究者报告并公布了漏洞细节 http://permalink.gmane.org/gmane.comp.security.oss.general/19669
2016.05.30 发布分析报告
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
11 Best PHP URL Shortener Scripts (Free and Premium)
Mar 03, 2025 am 10:49 AM
Long URLs, often cluttered with keywords and tracking parameters, can deter visitors. A URL shortening script offers a solution, creating concise links ideal for social media and other platforms. These scripts are valuable for individual websites a
Working with Flash Session Data in Laravel
Mar 12, 2025 pm 05:08 PM
Laravel simplifies handling temporary session data using its intuitive flash methods. This is perfect for displaying brief messages, alerts, or notifications within your application. Data persists only for the subsequent request by default: $request-
Build a React App With a Laravel Back End: Part 2, React
Mar 04, 2025 am 09:33 AM
This is the second and final part of the series on building a React application with a Laravel back-end. In the first part of the series, we created a RESTful API using Laravel for a basic product-listing application. In this tutorial, we will be dev
Simplified HTTP Response Mocking in Laravel Tests
Mar 12, 2025 pm 05:09 PM
Laravel provides concise HTTP response simulation syntax, simplifying HTTP interaction testing. This approach significantly reduces code redundancy while making your test simulation more intuitive. The basic implementation provides a variety of response type shortcuts: use Illuminate\Support\Facades\Http; Http::fake([ 'google.com' => 'Hello World', 'github.com' => ['foo' => 'bar'], 'forge.laravel.com' =>
cURL in PHP: How to Use the PHP cURL Extension in REST APIs
Mar 14, 2025 am 11:42 AM
The PHP Client URL (cURL) extension is a powerful tool for developers, enabling seamless interaction with remote servers and REST APIs. By leveraging libcurl, a well-respected multi-protocol file transfer library, PHP cURL facilitates efficient execution of various network protocols, including HTTP, HTTPS, and FTP. This extension offers granular control over HTTP requests, supports multiple concurrent operations, and provides built-in security features.
12 Best PHP Chat Scripts on CodeCanyon
Mar 13, 2025 pm 12:08 PM
Do you want to provide real-time, instant solutions to your customers' most pressing problems? Live chat lets you have real-time conversations with customers and resolve their problems instantly. It allows you to provide faster service to your custom
Announcement of 2025 PHP Situation Survey
Mar 03, 2025 pm 04:20 PM
The 2025 PHP Landscape Survey investigates current PHP development trends. It explores framework usage, deployment methods, and challenges, aiming to provide insights for developers and businesses. The survey anticipates growth in modern PHP versio
Notifications in Laravel
Mar 04, 2025 am 09:22 AM
In this article, we're going to explore the notification system in the Laravel web framework. The notification system in Laravel allows you to send notifications to users over different channels. Today, we'll discuss how you can send notifications ov
