Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Magick.NET-Q16-AnyCPU | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-HDRI-x64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-HDRI-x86 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-OpenMP-x64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-arm64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-x64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-x86 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-AnyCPU | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-OpenMP-x64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-arm64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-x64 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q8-x86 | nuget | < 14.10.3 | 14.10.3 |
| Magick.NET-Q16-HDRI-arm64 | nuget | < 14.10.3 | 14.10.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a code injection in the HTML encoder of ImageMagick. The analysis of the source code of the HTML encoder (coders/html.c) revealed that the WriteHTMLImage function is responsible for generating the HTML output. Within this function, the href attributes of the <area> tags are constructed using the WriteHtmlEncodedString function to sanitize user-provided filenames. This function performs HTML entity encoding, which is not the correct sanitization method for URL attributes. An attacker can craft a filename that, when HTML-encoded, breaks out of the href attribute and injects malicious JavaScript code. The correct fix would be to use URL encoding for the href attribute values. Although the exact commit for the fix was not identified due to confusing information in the security advisories and release notes, the analysis of the source code strongly points to WriteHTMLImage as the vulnerable function.
WriteHTMLImagecoders/html.c
WriteHtmlEncodedStringcoders/html.c