CVE-2023-34152

Vulnerability

CVE-2023-34152 is a shell command injection vulnerability in ImageMagick's OpenBlob function when the software is compiled with the --enable-pipes configuration option [1][3]. The flaw occurs because the SanitizeString function only removes single quotes but does not filter other shell metacharacters such as backticks and double quotes, allowing an attacker to inject arbitrary commands through a specially crafted image filename [3]. This vulnerability affects ImageMagick versions where the --enable-pipes option is enabled, and it is an incomplete fix for the earlier CVE-2016-5118 [3].

Exploitation

An attacker must have the ability to supply a malicious image filename to an ImageMagick command (e.g., identify, convert) on a system compiled with --enable-pipes [3]. The attack requires no additional authentication beyond normal file system access. By creating a file whose name contains shell metacharacters such as backticks or double quotes, the attacker can execute arbitrary commands when ImageMagick processes that file. For example, a file named |smile"cat test.txt > leak.txt".gif triggers the injection, where cat test.txt > leak.txt runs as a shell command [3]. No user interaction beyond the standard command execution is required.

Impact

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the ImageMagick process [1][2][3]. This leads to full remote code execution, including unauthorized data access, modification, or system compromise. The impact is limited only by the permissions of the running process and system security controls.

Mitigation

The Red Hat Product Security team has classified this as a configuration issue rather than a vulnerability in the default configuration, closing the bug as NOTABUG [2]. As of the published references, no official patch has been released. The recommended mitigation is to avoid using the --enable-pipes compile-time option unless absolutely necessary, as this feature explicitly enables pipe (shell command) support in filenames [3]. Users who cannot recompile without the option should sanitize filenames manually before passing them to ImageMagick.