mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 12:43:23 +00:00
158 lines
13 KiB
Markdown
158 lines
13 KiB
Markdown
# ImageMagick Security
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|
||
|
||
**This post was copied from** [**https://blog.doyensec.com/2023/01/10/imagemagick-security-policy-evaluator.html**](https://blog.doyensec.com/2023/01/10/imagemagick-security-policy-evaluator.html)****
|
||
|
||
During our audits we occasionally stumble across [ImageMagick](https://imagemagick.org/) security policy configuration files (`policy.xml`), useful for limiting the default behavior and the resources consumed by the library. In the wild, these files often contain a plethora of recommendations cargo cultured from around the internet. This normally happens for two reasons:
|
||
|
||
* Its options are only generally described on the online documentation page of the library, with no clear breakdown of what each security directive allowed by the policy is regulating. While the architectural complexity and the granularity of options definable by the policy are the major obstacles for a newbie, the corresponding knowledge base could be more welcoming. By default, ImageMagick comes with an unrestricted policy that must be tuned by the developers depending on their use. According to the docs, _“this affords maximum utility for ImageMagick installations that run in a sandboxed environment, perhaps in a Docker instance, or behind a firewall where security risks are greatly diminished as compared to a public website.”_ A secure strict policy is also made available, however [as noted in the past](https://www.synacktiv.com/en/publications/playing-with-imagetragick-like-its-2016.html) not always is well configured.
|
||
* ImageMagick [supports over 100 major file formats](https://imagemagick.org/script/formats.php#supported) (not including sub-formats) types of image formats. The infamous vulnerabilities affecting the library over the years produced a number of urgent security fixes and workarounds involving the addition of policy items excluding the affected formats and features (ImageTragick in [2016](https://imagetragick.com/), [@taviso](https://twitter.com/taviso)’s RCE via GhostScript in [2018](https://seclists.org/oss-sec/2018/q3/142), [@insertScript](https://twitter.com/insertScript)’s shell injection via PDF password in [2020](https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html), [@alexisdanizan](https://twitter.com/alexisdanizan)’s in [2021](https://www.synacktiv.com/en/publications/playing-with-imagetragick-like-its-2016.html)).
|
||
|
||
### Towards safer policies <a href="#towards-safer-policies" id="towards-safer-policies"></a>
|
||
|
||
With this in mind, we decided to study the effects of all the options accepted by ImageMagick’s security policy parser and write a [tool to assist both the developers and the security teams in designing and auditing these files](https://imagemagick-secevaluator.doyensec.com/). Because of the number of available options and the need to explicitly deny all insecure settings, this is usually a manual task, which may not identify subtle bypasses which undermine the strength of a policy. It’s also easy to set policies that appear to work, but offer no real security benefit. The tool’s checks are based on our research aimed at helping developers to harden their policies and improve the security of their applications, to make sure policies provide a meaningful security benefit and cannot be subverted by attackers.
|
||
|
||
The tool can be found at [imagemagick-secevaluator.doyensec.com/](https://imagemagick-secevaluator.doyensec.com/).
|
||
|
||
### Allowlist vs Denylist approach <a href="#allowlist-vs-denylist-approach" id="allowlist-vs-denylist-approach"></a>
|
||
|
||
A number of seemingly secure policies can be found online, specifying a list of insecure coders similar to:
|
||
|
||
```xml
|
||
...
|
||
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
|
||
<policy domain="coder" rights="none" pattern="EPI" />
|
||
<policy domain="coder" rights="none" pattern="EPS" />
|
||
<policy domain="coder" rights="none" pattern="MSL" />
|
||
<policy domain="coder" rights="none" pattern="MVG" />
|
||
<policy domain="coder" rights="none" pattern="PDF" />
|
||
<policy domain="coder" rights="none" pattern="PLT" />
|
||
<policy domain="coder" rights="none" pattern="PS" />
|
||
<policy domain="coder" rights="none" pattern="PS2" />
|
||
<policy domain="coder" rights="none" pattern="PS3" />
|
||
<policy domain="coder" rights="none" pattern="SHOW" />
|
||
<policy domain="coder" rights="none" pattern="TEXT" />
|
||
<policy domain="coder" rights="none" pattern="WIN" />
|
||
<policy domain="coder" rights="none" pattern="XPS" />
|
||
...
|
||
```
|
||
|
||
In ImageMagick 6.9.7-7, an [unlisted change](https://blog.awm.jp/2017/02/09/imagemagick-en/) was pushed. The policy parser changed behavior from disallowing the use of a coder if there was at least one `none`-permission rule in the policy to respecting the last matching rule in the policy for the coder. This means that it is possible to adopt an allowlist approach in modern policies, first denying all coders `rights` and enabling the vetted ones. A more secure policy would specify:
|
||
|
||
```xml
|
||
...
|
||
<policy domain="delegate" rights="none" pattern="*" />
|
||
<policy domain="coder" rights="none" pattern="*" />
|
||
<policy domain="coder" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
|
||
...
|
||
```
|
||
|
||
### Case sensitivity <a href="#case-sensitivity" id="case-sensitivity"></a>
|
||
|
||
Consider the following directive:
|
||
|
||
```
|
||
...
|
||
<policy domain="coder" rights="none" pattern="ephemeral,epi,eps,msl,mvg,pdf,plt,ps,ps2,ps3,show,text,win,xps" />
|
||
...
|
||
```
|
||
|
||
With this, conversions will still be allowed, since policy patterns are case sensitive. Coders and modules must always be upper-case in the policy (e.g. “EPS” not “eps”).
|
||
|
||
### Resource limits <a href="#resource-limits" id="resource-limits"></a>
|
||
|
||
Denial of service in ImageMagick is quite easy to achieve. To get a fresh set of payloads it’s convenient to search [“oom”](https://github.com/ImageMagick/ImageMagick/issues?q=oom) or similar keywords in the recently opened issues reported on the Github repository of the library. This is an issue since an ImageMagick instance accepting potentially malicious inputs (which is often the case) will always be prone to be exploited. Because of this, the tool also reports if reasonable limits are not explicitly set by the policy.
|
||
|
||
### Policy fragmentation <a href="#policy-fragmentation" id="policy-fragmentation"></a>
|
||
|
||
Once a policy is defined, it’s important to make sure that the policy file is taking effect. ImageMagick packages bundled with the distribution or installed as dependencies through multiple package managers may specify different policies that interfere with each other. A quick `find` on your local machine will identify multiple occurrences of `policy.xml` files:
|
||
|
||
```shell-session
|
||
$ find / -iname policy.xml
|
||
|
||
# Example output on macOS
|
||
/usr/local/etc/ImageMagick-7/policy.xml
|
||
/usr/local/Cellar/imagemagick@6/6.9.12-60/etc/ImageMagick-6/policy.xml
|
||
/usr/local/Cellar/imagemagick@6/6.9.12-60/share/doc/ImageMagick-6/www/source/policy.xml
|
||
/usr/local/Cellar/imagemagick/7.1.0-45/etc/ImageMagick-7/policy.xml
|
||
/usr/local/Cellar/imagemagick/7.1.0-45/share/doc/ImageMagick-7/www/source/policy.xml
|
||
|
||
# Example output on Ubuntu
|
||
/usr/local/etc/ImageMagick-7/policy.xml
|
||
/usr/local/share/doc/ImageMagick-7/www/source/policy.xml
|
||
/opt/ImageMagick-7.0.11-5/config/policy.xml
|
||
/opt/ImageMagick-7.0.11-5/www/source/policy.xml
|
||
|
||
```
|
||
|
||
Policies can also be configured using the [-limit](https://imagemagick.org/script/command-line-options.php#limit) CLI argument, [MagickCore API](https://imagemagick.org/api/resource.php#SetMagickResourceLimit) methods, or with environment variables.
|
||
|
||
### A starter, restrictive policy <a href="#a-starter-restrictive-policy" id="a-starter-restrictive-policy"></a>
|
||
|
||
Starting from the most restrictive policy described in the official documentation, we designed a restrictive policy gathering all our observations:
|
||
|
||
```xml
|
||
<policymap xmlns="">
|
||
<policy domain="resource" name="temporary-path" value="/mnt/magick-conversions-with-restrictive-permissions"/> <!-- the location should only be accessible to the low-privileged user running ImageMagick -->
|
||
<policy domain="resource" name="memory" value="256MiB"/>
|
||
<policy domain="resource" name="list-length" value="32"/>
|
||
<policy domain="resource" name="width" value="8KP"/>
|
||
<policy domain="resource" name="height" value="8KP"/>
|
||
<policy domain="resource" name="map" value="512MiB"/>
|
||
<policy domain="resource" name="area" value="16KP"/>
|
||
<policy domain="resource" name="disk" value="1GiB"/>
|
||
<policy domain="resource" name="file" value="768"/>
|
||
<policy domain="resource" name="thread" value="2"/>
|
||
<policy domain="resource" name="time" value="10"/>
|
||
<policy domain="module" rights="none" pattern="*" />
|
||
<policy domain="delegate" rights="none" pattern="*" />
|
||
<policy domain="coder" rights="none" pattern="*" />
|
||
<policy domain="coder" rights="write" pattern="{PNG,JPG,JPEG}" /> <!-- your restricted set of acceptable formats, set your rights needs -->
|
||
<policy domain="filter" rights="none" pattern="*" />
|
||
<policy domain="path" rights="none" pattern="@*"/>
|
||
<policy domain="cache" name="memory-map" value="anonymous"/>
|
||
<policy domain="cache" name="synchronize" value="true"/>
|
||
<!-- <policy domain="cache" name="shared-secret" value="my-secret-passphrase" stealth="True"/> Only needed for distributed pixel cache spanning multiple servers -->
|
||
<policy domain="system" name="shred" value="2"/>
|
||
<policy domain="system" name="max-memory-request" value="256MiB"/>
|
||
<policy domain="resource" name="throttle" value="1"/> <!-- Periodically yield the CPU for at least the time specified in ms -->
|
||
<policy xmlns="" domain="system" name="precision" value="6"/>
|
||
</policymap>
|
||
```
|
||
|
||
You can verify that a security policy is active using the `identify` command:
|
||
|
||
```
|
||
identify -list policy
|
||
Path: ImageMagick/policy.xml
|
||
...
|
||
```
|
||
|
||
You can also play with the above policy using our evaluator tool while developing a tailored one.
|
||
|
||
|
||
|
||
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|