# Remote Code Execution on ownCloud instances with ImageMagick installed

SVG referencing an MSL file tricks ImageMagick preview generation into writing attacker PHP into index.php, yielding RCE on ownCloud.

- Payout: hidden
- Severity: critical
- Program: ownCloud
- Found by: lukasreschke
- Disclosed: 2023-04-12
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1838674
- Library page: https://bugbountylibrary.com/r/h1%3A1838674
- Tags: area:web domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:chained vuln:file-upload vuln:rce

**Target:** ownCloud core preview generation (OC\Preview\Bitmap) using ImageMagick
**Root cause:** Preview generation passes attacker-controlled SVG to ImageMagick, which follows the msl: pseudo-protocol and executes MSL instructions including arbitrary file write.
**Steps:**
1. Deploy owncloud/server:10.11 with imagemagick installed
2. Upload `exploit.msl` containing `<read filename="/mnt/data/files/admin/files/Photos/Portugal.jpg"/>`, `<resize geometry="400x400"/>`, `<comment><?php echo php_uname(); ?></comment>`, `<write filename="/var/www/owncloud/index.php"/>`
3. Upload `image.rgb` (SVG) with `<image xlink:href="msl:/mnt/data/files/admin/files/exploit.msl" .../>`
4. Trigger preview generation by reloading; ImageMagick processes the SVG, follows msl: and writes PHP into index.php
5. Reload index.php to execute the injected PHP
**How found:** Recognized that ownCloud's Bitmap previewer invokes ImageMagick on user-uploaded files, then leveraged ImageMagick's MSL pseudo-protocol (reachable via SVG xlink:href) to turn preview rendering into arbitrary file write.
**Exploitation:** Attacker with upload capability (account or File Drop Folder) uploads an MSL payload and an SVG referencing it via msl: pseudo-protocol; preview generation executes the MSL, overwriting index.php with PHP code, achieving RCE on next request.
**Insight:** When a target shells out to ImageMagick for thumbnails, test SVG/MSL/MVG pseudo-protocol references (msl:, mvg:, etc.) to convert image parsing into file read/write; knowing the upload path lets you point MSL read/write at webroot files.