ImageMagick has a Path Policy TOCTOU symlink race bypass

Vulnerability: TOCTOU Race Condition in Path Policy Check

ImageMagick versions prior to 7.1.2-16 and 6.9.13-41 contain a time-of-check time-of-use (TOCTOU) race condition in the domain="path" authorization mechanism. The policy check occurs before the final file open or use, but an attacker can swap a symlink between the check and the use, bypassing policy-denied read or write operations [1][2].

Exploitation

An attacker with the ability to create and modify symlinks on the filesystem (e.g., via a local account or a compromised process) can exploit this race condition. By rapidly swapping a symlink between a permitted path and a restricted path, the attacker can trick ImageMagick into reading or writing files that the policy intended to block. No special privileges beyond filesystem write access to the symlink location are required [3][4].

Impact

Successful exploitation allows an attacker to read or write arbitrary files that are otherwise denied by the ImageMagick security policy. This could lead to information disclosure (reading sensitive files) or arbitrary file write, potentially enabling further compromise of the system or data integrity [2][4].

Mitigation

The vulnerability is fixed in ImageMagick versions 7.1.2-16 and 6.9.13-41 [1][2]. Users should upgrade to these versions or later. The fix addresses the race condition by ensuring the policy check is performed atomically with the file open operation [3][4].