The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 6.9.6.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ImageMagick, an image processing library, is affected through its HTTP and FTP image handlers. A remote attacker could use a specially crafted image to make the server send requests to internal or other unintended destinations, exposing internal resources.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 19
git.imagemagick.org
lists.opensuse.org
oracle.com
ubuntu.com
securityfocus.com
Exploit-DB
lists.debian.org
openwall.com
security.gentoo.org
debian.org
rhn.redhat.com
Questions about CVE-2016-3718
What should I do about it?
Upgrade to ImageMagick 6.9.6.2 or later, the version listed as the fix. No workaround is known at this time.Source: security.gentoo.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
Why do the sources disagree?
The description says remote attackers can trigger the flaw through the HTTP and FTP coders. The CVSS vector is marked AV:L, which indicates local access only. The sources conflict on how the attack is reached.Source: security.gentoo.org