CVE Vulnerability

CVE-2022-24720

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada Patch
https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446 Exploit Vendor Advisory
https://www.debian.org/security/2022/dsa-5310 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:image_processing_project:image_processing:*:*:*:*:*:ruby:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Information

Published : 2022-03-01 11:15

Updated : 2023-02-22 05:49

NVD link : CVE-2022-24720

Mitre link : CVE-2022-24720

Products Affected
No products.
CWE
CWE-20