CVE-2022-24720

 

Published at: - 02-03-2022 12:15

Last modified: - 09-03-2022 06:58

Total changes: - 3

Description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
• https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446

 

Keywords

NVD

 

CVE-2022-24720

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures