Abstract

Recently, a number of vulnerabilities have been found in a very popular library, which is used to process image files.  The vulnerabilities allow the attacker to execute code, move, read or delete remote files and issue outgoing requests from a web server. In certain scenarios, the vulnerability even can be exploited without authentication, making this a very powerful vulnerability and dangerous to unpatched web servers.

This article will explain how those vulnerabilities can be mitigated using F5s Big-IP with ASM provisioned. 

ImageMagic

ImageMagick is very popular piece of software, many programming languages have interface for ImageMagick allowing the programmatic access to image processing and editing. It runs on Linux, Windows, Mac, iOS and many more:

Quoting the ImageMagick.org

The functionality of ImageMagick® is typically utilized from the command-line or you can use the features from programs written in your favorite language. Choose from these interfaces: G2F (Ada), MagickCore (C), MagickWand (C), ChMagick (Ch), ImageMagickObject (COM+), Magick++ (C++), JMagick (Java), L-Magick (Lisp), Lua (LuaJIT), NMagick (Neko/haXe), Magick.NET (.NET), PascalMagick (Pascal),PerlMagick (Perl), MagickWand for PHP (PHP), IMagick (PHP), PythonMagick (Python), RMagick (Ruby), or TclMagick (Tcl/TK). With a language interface, use ImageMagick to modify or create images dynamically and automagically.

MVG format

MVG stands for Magick Vector Graphics, and it is a modularized language for describing two-dimensional vector graphics using the ImageMagick engine. It can look like this:
 

push graphic-context
viewbox 0 0 400 400
image over 0,0 0,0 'label:@/home/files/nice_text'
pop graphic-context

In this example, the ImageMagick engine reads the text from the 'nice_text' file and draws a label with its contents over the picture. 

Vulnerability - ImageTragick

The group of vulnerabilities was named ImageTragick because they exploit the ImageMagick package.   The package contains several “coders” supporting instructions and commands for image manipulation. For instance, using the “label” instruction one can add a free text from a file to an image. Several instructions were found to be vulnerable to different types of attack.

More detailed information on each vulnerability can be found in the researchers’ website: https://imagetragick.com/

We could distinguish those findings as three types of vulnerabilities:

1. Shell Command Execution
2. Application Abuse of Functionality
3. Server Side Request Forgery

Shell Command Execution

CVE-2016-3714

By abusing this type of vulnerability, the attacker can cause the ImageMagick library to pass commands to the operation system shell potentially ending up in complete system compromise. Considering ImageMagick’s availability for all the popular operating systems and programming languages makes this vulnerability a very dangerous one.

Attacker can create a file in ImageMagick MVG and SVG format and upload it to a webserver, which will process this file. Successfully performing this operation will cause ImageMagick to execute the command from the crafted file.

Example: 

fill 'url(https://example.com/image.jpg";|ls -la")'

The vulnerable code takes the URL and without proper validation concatenates it to the “wget” system command to fetch the image. Attacker is able to provide a URL ending with a double quote character and concatenate additional arbitrary system commands, such as a “ping” command (“ping www.f5.com”) in the above example. If the server is vulnerable, it will contact www.f5.com. Attackers can replace the “ping” command by something less naive, such as, changing the password of the 'root' account or installing a malware or a backdoor to gain control over the server.

ImageTragick Application Abuse

It was found that some coders include functionality that could be misused in order to perform the following operations on the server:

CVE-2016-3715 – Delete file
CVE-2016-3716 – File moving
CVE-2016-3717 – Local File Read

The “EPHEMERAL” coder could be abused to delete files from the server just by providing a file name, as it deletes the file after reading it.

Example : 

image over 0,0 0,0 'ephemeral://critical.file'

The “label” instruction of the MVG coder could be abused to read the content of an arbitrary file on the server.

Example : 

image over 0,0 0,0 'label:@/etc/passwd'

However, CVE-2016-3716 is even more interesting application abuse use case as, just by using the “read” and “write” directives of the MSL coder an attacker could potentially compromise a remote server.

In the full attack scenario, attacker will upload an “image” file containing PHP code with a valid image extension, say “image.gif”. 

<?php
phpinfo(); //Show all information, defaults to INFO_ALL
?>
<!-- image.gif that will be renamed to backdoor.php -->

The next step will be uploading an MSL file with the “read” directive which will read the content of the previously uploaded “image” file and also with the “write” directive which will write this content to a web accessible directive while renaming the file to have a PHP extension to make it executable.

Example: 

<?xml version="1.0" encoding="UTF-8"?>
<image>
<read  filename="/tmp/image.gif" />
<write filename="/var/www/shell.php" />
</image>
<!-- script.msl --!>

Finally, the attacker will upload another MVG file that will execute previously uploaded MSL file using the “msl” pseudo protocol.

Example: 

image over 0,0 0,0 'msl:/files/script.msl'

This example uses the 'phpinfo()' function in the PHP backdoor file, as a simple indication that the exploit worked, however attacker can replace this command with a webshell such as described in our previous posts.

Server Side Request Forgery

Same “url” directive used in the MVG/SVG format could be also abused to cause the server send HTTP or FTP requests for example to another server inside the server’s internal network that could not be accessible from the outside world, by providing a URL with an IP address of the internal network. This vulnerability is tracked as CVE-2016-3718.  

Mitigation 

It is possible to protect against the ImageTragick vulnerabilities using Big-IP ASM. Using WAF for “virtually patching” the application could be even critical as a protection tool especially before the patch for the backend code is available or has been deployed.

Although the “Shell Command Execution” vulnerabilities are 0-day vulnerabilities, meaning previously unknown attack vector, the post-exploitation has the same pattern, attempting to smuggle and execute operation system commands on the attacked server and will be mitigated by the existing “Command Execution” attack signatures.

For instance, signature ID 200003041 (“ls” execution attempt) will spot an attacker who is trying to smuggle the “ls –la” system command while exploiting CVE-2016-3714.

We have also released Attack Signature Update to detect and mitigate the specific ImageMagick application abuse and server side request forgery vulnerabilities.

It is recommended to patch the vulnerabilities in the code and follow some basic remediation steps:

• Consider disabling the unsafe coders
• Consult the ImageMagick recommendation:
  http://www.imagemagick.org/discourse-server/viewtopic.php?t=29588
• Webserver should run with the lowest permissions 
• Always patch the systems