# [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick

Outdated ImageMagick on HackerOne resized uploaded PNGs, embedding local file contents (e.g. /etc/passwd) into the output image metadata.

- Payout: hidden
- Severity: critical
- Program: HackerOne
- Found by: mikkocarreon
- Disclosed: 2023-03-16
- CVE: CVE-2022-44268
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1858574
- Library page: https://bugbountylibrary.com/r/h1%3A1858574
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:critical tech:payment technique:source-review vuln:file-upload vuln:info-disclosure

**Target:** Image upload/resize endpoint (profile picture)
**Root cause:** Outdated ImageMagick vulnerable to CVE-2022-44268: a crafted PNG with a tEXt profile chunk causes the resize operation to read an arbitrary local file and embed its hex-encoded contents in the output image's profile metadata.
**Steps:**
1. Craft PNG `im-lfi.png` with a `tEXt` chunk whose profile value is a filename like `/etc/passwd`.
2. Upload it as profile picture via profile edit and save.
3. Download the resized image produced by the server.
4. Run `identify -verbose image.png` and extract the `Raw profile type:` hex blob.
5. Decode hex with `python -c "print(bytes.fromhex('...').decode())"` to read the leaked file contents.
**How found:** Researcher recognized the target used ImageMagick for image conversion/resizing and tested the known CVE-2022-44268 payload against the avatar upload flow.
**Exploitation:** Attacker uploads a malicious PNG; server-side ImageMagick resize reads the referenced local file and writes its hex contents into the resized image metadata, which the attacker downloads to exfiltrate arbitrary files readable by the service.
**Insight:** Any user-facing image upload that server-side resizes with ImageMagick is a candidate for CVE-2022-44268; test by uploading a PNG with a tEXt profile chunk naming a local file and inspecting the resized output's metadata for hex-encoded contents.