Improper Input Validation in image_processing

Vulnerability

CVE-2022-24720 is a command injection vulnerability in the image_processing gem (versions prior to 1.12.2) that affects both the libvips and ImageMagick/GraphicsMagick backends. The flaw resides in the #apply method, which accepts a series of operations from unsanitized user input. Because Active Storage variants internally call this method, Active Storage is also vulnerable. The vulnerability allows an attacker to craft a malicious operation hash—for example, { system: 'echo EXECUTED' }—that results in shell command execution [1][4].

Exploitation

An attacker must be able to provide unsanitized user input that is passed to the #apply method of ImageProcessing::Vips or ImageProcessing::MiniMagick. This input can be supplied through web application parameters that are not filtered or validated. The attacker can construct a hash containing a :system key with a shell command string. When #apply processes the operations, the command is executed. No authentication is required if the application exposes the vulnerable endpoint; the attack does not require any special network position beyond being able to send HTTP requests to the application [4].

Impact

Successful exploitation results in arbitrary shell command execution on the server with the privileges of the application process (typically the web server user). This can lead to full compromise of the affected system, including data exfiltration, installation of malware, or lateral movement within the network. The vulnerability has a CVSS score of 9.8 (Critical) due to its low attack complexity and network-based attack vector [1].

Mitigation

The vulnerability is fixed in image_processing version 1.12.2. Users should upgrade immediately. As a workaround, developers must sanitize user input by allowing only a constrained set of operations, such as by whitelisting allowed operation names like resize_to_limit and strip before passing them to #apply [1][4].