XML injection in ImageMagick - CVE-2020-29599

Vulnerability identifier: #VU48940

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-29599

CWE-ID: CWE-91

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

ImageMagick
Gentoo Linux
Amazon Linux AMI
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Ubuntu
ImageMagick (Red Hat package)
imagemagick6 (Alpine package)
imagemagick (Alpine package)
libmagickcore-6.q16hdri-6 (Ubuntu package)
libmagickcore-6.q16-dev (Ubuntu package)
imagemagick-6-common (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libmagickwand-6.q16-6 (Ubuntu package)
libmagickcore-dev (Ubuntu package)
libimage-magick-q16-perl (Ubuntu package)
imagemagick-6.q16hdri (Ubuntu package)
libimage-magick-perl (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagick++-dev (Ubuntu package)
imagemagick-common (Ubuntu package)
perlmagick (Ubuntu package)
libmagick++-6.q16-dev (Ubuntu package)
libmagick++-6.q16hdri-8 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
imagemagick (Ubuntu package)
libmagickwand-6.q16-dev (Ubuntu package)
libmagickcore-6-headers (Ubuntu package)
libmagickwand-6.q16-2 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagick++-6.q16hdri-dev (Ubuntu package)
libmagickcore-6.q16hdri-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickwand-dev (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickwand-6.q16-3 (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16hdri-7 (Ubuntu package)
Data Computing Appliance (DCA)

Install update from vendor's website.

ImageMagick - update to 7.0.10-40
ImageMagick (Red Hat package) - update to 6.9.10.68-5.el7_9
imagemagick (Alpine package) - update to 7.0.10.48-r0
libmagickcore-6.q16hdri-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5
imagemagick-6-common (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-q16-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6.q16hdri (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-common (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
perlmagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6-headers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-6.q16-5v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-6.q16hdri-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16hdri-3 (Ubuntu package) - update to Ubuntu Pro
libmagick++-6.q16-7 (Ubuntu package) - update to Ubuntu Pro
libmagickwand-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-3 (Ubuntu package) - update to Ubuntu Pro
libmagickwand-6.q16-3 (Ubuntu package) - update to Ubuntu Pro
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-7 (Ubuntu package) - update to Ubuntu Pro
Data Computing Appliance (DCA) - update to 4.3.0.0

• Exploit #7383 - CVE-2020-29599 () (February 23, 2022)
• Exploit #7298 - CVE-2020-29599 () (January 30, 2022)

• https://github.com/ImageMagick/ImageMagick/discussions/2851
• https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html

• XML injection in ImageMagick
• XML injection in imagemagick (Alpine package)
• XML injection in imagemagick6 (Alpine package)
• Red Hat Enterprise Linux 7 update for ImageMagick
• Gentoo update for ImageMagick
• Amazon Linux AMI update for ImageMagick
• CentOS 7 update for ImageMagick
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Ubuntu update for imagemagick