3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vghg-5jrg-2398

GHSA-vghg-5jrg-2398: ImageMagick: Policy Bypass in script operation due to missing checks

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vghg-5jrg-2398

GHSA-vghg-5jrg-2398:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-OpenMP-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-AnyCPU	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-OpenMP-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-arm64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-x64	nuget	< 14.15.0	14.15.0
Magick.NET-Q8-x86	nuget	< 14.15.0	14.15.0
Magick.NET-Q16-HDRI-arm64	nuget	< 14.15.0	14.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a policy bypass in the -script operation of ImageMagick. The analysis of the provided patch e047ee2c7b937c1db92302fe3701e2e9c169de27 confirms this. The patch adds a security policy check to the AcquireScriptTokenInfo function in MagickWand/script-token.c. This function is directly related to the -script operation. The added code explicitly checks if the provided filename is authorized for reading using IsPathAuthorized. The absence of this check in the vulnerable versions allowed for the policy bypass. Therefore, the AcquireScriptTokenInfo function is the vulnerable function, as it was the entry point for processing the malicious input (the script filename) without proper validation.

Vulnerable functions

AcquireScriptTokenInfo

MagickWand/script-token.c

The `AcquireScriptTokenInfo` function is responsible for handling the `-script` operation. Prior to the patch, this function did not check if the provided filename was authorized by the security policy. This allowed an attacker to bypass the policy and read files from unauthorized paths by using the `-script` operation with a malicious filename. The patch introduces a call to `IsPathAuthorized` to ensure the filename is allowed by the security policy before processing it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

3.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-vghg-5jrg-2398: ImageMagick: Policy Bypass in script operation due to missing checks

GHSA-vghg-5jrg-2398:

3.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

GHSA-vghg-5jrg-2398: ImageMagick: Policy Bypass in script operation due to missing checks

3.3

3.3

Basic Information

Basic Information

3.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-vghg-5jrg-2398: ImageMagick: Policy Bypass in script operation due to missing checks

GHSA-vghg-5jrg-2398:

3.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-vghg-5jrg-2398: ImageMagick: Policy Bypass in script operation due to missing checks

3.3

3.3

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI