ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick's "secure" security policy includes a rule to prevent reading from or writing to standard streams by blocking the "-" filename pattern. However, ImageMagick also supports fd: pseudo-filenames (e.g., fd:0, fd:1) that are not covered by this rule. Prior to versions 7.1.2-15 and 6.9.13-40, the policy templates omit blocking the "fd:*" pattern, allowing an attacker to bypass the intended stdin/stdout restriction [2][4].

An attacker who can supply an input or output filename to ImageMagick (or an application using it) can specify fd:0 for stdin or fd:1 for stdout. This bypasses the secure policy and may enable reading from stdin or writing to stdout even when the policy explicitly prohibits it. The vulnerability is identified as GHSA-xwc6-v6g8-pw2h and is listed among security fixes in related software [3].

The impact is a security policy bypass that can lead to unintended access to standard streams, potentially allowing data leakage or injection depending on the context in which ImageMagick is used. Since the secure policy is intended to restrict file operations, this bypass undermines the protection goal [2].

The issue is patched in ImageMagick versions 7.1.2-15 and 6.9.13-40 by adding "" to the secure policy templates [4]. As a workaround, users can manually add this rule to their security policy configuration [2].