Arbitrary Code Execution in `AppImage` version `ImageMagick`

Vulnerability

The AppImage version of ImageMagick (prior to 7.11-36) sets the MAGICK_CONFIGURE_PATH and LD_LIBRARY_PATH environment variables in its AppRun script in a way that can include empty path segments. For example, when no pre-existing value is set, the exported paths may begin or end with a colon (e.g., ::/some/path:), effectively including the current working directory as an empty path component. This allows ImageMagick to load configuration files or shared libraries from an arbitrary directory if an attacker can place malicious files there. The issue is present in the AppRun script as seen in references [1] and [3].

Exploitation

An attacker with the ability to write files to the current working directory where a victim runs the ImageMagick AppImage can craft a malicious magic.xml or other configuration file, or a malicious shared library, that will be loaded by ImageMagick due to the empty path being interpreted as the current directory. The attacker does not require elevated privileges or authentication beyond the ability to place files in the victim’s working directory (e.g., via a shared folder or by tricking the user into extracting a malicious archive). The victim must execute the AppImage from that directory, triggering the environment variable expansion.

Impact

Successful exploitation leads to arbitrary code execution in the context of the user running ImageMagick. The attacker can achieve full compromise of the user’s session, including data theft, malware installation, or lateral movement, depending on the user’s privileges.

Mitigation

The vulnerability is fixed in ImageMagick version 7.11-36, released on or before 2024-07-29 [1]. The fix, visible in the commit at reference [2], ensures that environment variable assignments do not introduce empty path components by using proper colon-delimiting with parameter expansion (${VAR:+:$VAR}). Users of the AppImage should upgrade to version 7.11-36 or later. No workaround is available for earlier versions; the only mitigation is to avoid running the AppImage in directories writable by untrusted users.