Server Side Request Forgery in ImageMagick - CVE-2016-3718

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU5850

Server Side Request Forgery in ImageMagick - CVE-2016-3718

Published: February 17, 2017 / Updated: February 20, 2022


Vulnerability identifier: #VU5850
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N]
CVE-ID: CVE-2016-3718
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to perform server-side forgery attacks and compromise vulnerable application.

The weakness exists due to the failure to properly prevent the disclosure of file contents when processing certain MVG files. A remote attacker can persuade the victim to open specially crafted images using the .mvg file to trick the victim host into performing HTTP requests or opening FTP sessions.

Successful exploitation of this vulnerability may allow an attacker to perform SSRF attack to retrieve information for further attacks against vulnerable system by performing unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.

Affected software

ImageMagick
Gentoo Linux
Amazon Linux AMI
SUSE Linux
Ubuntu
Slackware Linux
Opensuse
imagemagick (Ubuntu package)
libmagickcore4 (Ubuntu package)
libmagick++4 (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagickcore5 (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)

How to mitigate CVE-2016-3718

Update to version 6.9.3-10 or 7.0.1-1.

imagemagick (Ubuntu package) - addressed in versions 8:6.6.9.7-5ubuntu3.4, 8:6.7.7.10-6ubuntu3.1, 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagickcore4 (Ubuntu package) - update to 8:6.6.9.7-5ubuntu3.4
libmagick++4 (Ubuntu package) - update to 8:6.6.9.7-5ubuntu3.4
imagemagick-common (Ubuntu package) - addressed in versions 8:6.6.9.7-5ubuntu3.4, 8:6.7.7.10-6ubuntu3.1, 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagickcore5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.1
libmagick++5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.1
libmagickcore-6.q16-2 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagick++-6.q16-5v5 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins