Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2024-41817

Description

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

POC

Reference

- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8

Github

- https://github.com/Dxsk/CVE-2024-41817-poc

- https://github.com/EndlssNightmare/Portifolio

- https://github.com/OneGoshko12/htb-titanic

- https://github.com/PuddinCat/GithubRepoSpider

- https://github.com/fkie-cad/nvd-json-data-feeds

- https://github.com/maikneysm/AutoPwn-Titanic.htb

- https://github.com/mxdelta/CVE

- https://github.com/plzheheplztrying/cve_monitor

- https://github.com/sorshi/comistream-reader

- https://github.com/zhanpengliu-tencent/medium-cve