Listen to this Post
This vulnerability occurs due to insufficient cycle detection when parsing MVG (Magick Vector Graphics) files. When ImageMagick processes an MVG file that references another MVG, which in turn points back to the first, it creates a circular dependency. The `RenderMVGContent()` function in `draw.c` recursively calls `DrawImage()` for the referenced file without validating if it has already been processed in the current call chain. This leads to infinite recursion between ReadMVGImage, RenderMVGContent, and DrawPrimitive. Each recursive call consumes stack space for function parameters and local variables. Since the recursion is unbounded, it eventually exhausts the allocated stack memory, resulting in a stack overflow crash and Denial of Service (DoS). The issue is triggered during the initial image read/parse phase, requiring no special rendering or conversion steps.
Platform: ImageMagick
Version: 7.1.0-61
Vulnerability: Stack Overflow
Severity: Critical
date: 2023-06-03
Prediction: 2023-07-15
What Undercode Say:
$ magick convert circular_ref.mvg out.png stack smashing detected $ identify -list format | grep MVG MVG rw+ Magick Vector Graphics $ strings poc.mvg | head -5 image over 0,0 0,0 'cyclic.mvg'
How Exploit:
Craft two MVG files referencing each other. An attacker uploads the malicious MVG to a web service using ImageMagick for processing, causing the application to crash.
Protection from this CVE:
Update ImageMagick. Implement resource limits (-limit). Sanitize input files. Use policy.xml to disable MVG format if unused.
Impact:
Application crash. Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
