[CVE-2022-44268] Arbitrary Remote Leak via ImageMagick

Summary

Last month, HackerOne was notified through the HackerOne Bug Bounty Program by a HackerOne community member (“hacker”) that they had been able to exploit a Local File Inclusion vulnerability on hackerone.com.

This vulnerability was present in an outdated version of ImageMagick. Our patch management procedure did not pick up the update, which addresses this vulnerability, due to a missing CVE reference and thereby we pushed the ImageMagic update to the regular update cycle rather than scheduling an immediate update.

After receiving the report, the HackerOne Incident Response team immediately mitigated the vulnerability, which was deployed to production within hours.

The Local File Inclusion vulnerability in ImageMagick can be exploited when uploaded images are being resized. By uploading a malicious PNG image, the resizing process will include the local file as content of the resized image in a hexadecimal representation. MetabaseQ has written a great blog post with more in depth information on the exploit.

Understanding whether this exploit was used outside of this report was a challenge since every image uploaded to our platform could be infected with this malicious payload. These malicious PNGs can be identified by searching for the string “tEXtprofile” in the image’s metadata.

However, on Amazon S3 we store many hundreds of gigabytes of PNG images that could contain this payload. To ensure this vulnerability wasn’t exploited beyond the vulnerability report; we wrote an AWS Lambda function that scanned through all the objects in these S3 buckets and identified any malicious payloads.

The technical investigation concluded that there were no malicious images stored in any of the S3 buckets apart from the image provided by the hacker on the report and images created by the Incident Response team to validate the vulnerability and confirm the patch was successfully rolled out.

In parallel to identifying any malicious use of the vulnerability, we performed a full rotation of application secrets that could theoretically have been accessed by this exploit, to err on the side of caution.

We continue to work on efforts to reduce the blast radius of exploits in ImageMagick.

We know that no organization is immune to software vulnerabilities. HackerOne runs its own bug bounty program to identify and fix any issues like this one, highlighted by @mikkocarreon. We believe in transparency and the vital role it plays in building trust, so any valid vulnerabilities discovered on our program are publicly disclosed once confirmed and resolved. We’d like to thank @mikkocarreon for sending in their report, allowing us to make our platform even more secure.