Listen to this Post
The vulnerability (CVE-2023-XXXXX) is triggered when ImageMagick’s MSL (Magick Scripting Language) parser processes a `coders/msl.c, the `MSLEndElement()` function handles the closing `
,"comment")` on a potentially NULL `msl_info->image[bash]` pointer. This occurs because the image array element remains NULL if a `<comment>` element is encountered before any image is loaded via <code><read></code>. In debug builds, the `DeleteImageProperty()` function in `property.c` contains an assertion `image != (Image ) NULL` that fails, causing an abort. In release builds, this leads to a direct NULL pointer dereference, resulting in a crash and Denial of Service (DoS). Platform: ImageMagick Version: 7.x Vulnerability: NULL Pointer Dereference Severity: Critical Date: Discovered 2023 <h2 style="color: blue;">Prediction: Patch Q4 2023</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] magick MSL:poc.msl out.png python3 infra/helper.py build_fuzzers imagemagick python3 infra/helper.py reproduce imagemagick msl_fuzzer poc.msl
extern "C" int LLVMFuzzerTestOneInput(const uint8_t Data, size_t Size) {
const Magick::Blob blob(Data, Size);
Magick::Image image;
image.magick("MSL");
image.read(blob);
}
How Exploit:
Craft MSL file with `` tag preceding ``.
Protection from this CVE
Apply vendor patch. Sanitize MSL input.
Impact:
DoS via crash. Potential code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
