# Image converter delegate command execution

Uploads reaching ImageMagick/Ghostscript delegates via pseudo-protocols or renamed PostScript, not real images

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $5,000; latest 2023-04-12. Updated 2026-10-23._

## How it works

Server-side image processing assumes an uploaded file is an image because of its extension or declared type. ImageMagick and GraphicsMagick instead sniff content and dispatch to external interpreters: PostScript/EPS goes to Ghostscript, and `msl:`, `mvg:` and similar pseudo-protocol references inside SVG are followed and executed. So a file that is not an image at all gets interpreted as instructions, and the converter becomes a code-execution path. The broken assumption is "the converter only parses pixels"; in reality it parses a language with file-write and command primitives.

## Where it shows up

- Upload endpoints feeding thumbnails/previews, avatars, product or profile images through ImageMagick or GraphicsMagick.
- Validation by extension or client Content-Type only, with no magic-byte check.
- SVG accepted and rendered server-side, especially with `xlink:href` pointing at `msl:`/`mvg:`.
- Bundled Ghostscript present and enabled as a delegate; old ImageMagick policy without disabling PS/EPS/MSL/MVG coders.
- Attacker-known write paths (web root, `index.php`) combined with a converter that can write files.

## How to review

Check the exact property: no uploaded byte stream may reach a delegate interpreter. Trace the upload from receipt to converter call. Confirm (a) content is validated by magic bytes against an allowlist of raster formats, (b) the ImageMagick policy.xml disables PS, EPS, MSL, MVG and related coders, and (c) SVG is either rejected or sanitized so no external/pseudo-protocol references survive. If any of these is missing, treat the endpoint as unsafe regardless of extension checks. Also verify the Ghostscript version is patched.

## Variants seen

- SVG referencing an MSL file drives ImageMagick to write attacker PHP into `index.php`, giving RCE on ownCloud preview generation [E1](https://bugbountylibrary.com/r/h1%3A1838674.md).
- Unvalidated upload plus Ghostscript-enabled ImageMagick executes a Postscript payload, yielding a shell and AWS metadata credentials [E2](https://bugbountylibrary.com/r/h1%3A422944.md).
- EPS/PostScript renamed `.gif` bypasses extension checks and triggers Ghostscript CVE-2017-8291 on profile image conversion [E3](https://bugbountylibrary.com/r/h1%3A365271.md).

## Impact and severity

All three reached remote code execution on production hosts, the highest severity. Worse factors: preview/thumbnail pipelines run automatically on upload, so no victim interaction is needed; cloud hosting exposed metadata credentials [E2](https://bugbountylibrary.com/r/h1%3A422944.md); and known write paths let file-write become code execution [E1](https://bugbountylibrary.com/r/h1%3A1838674.md). Extension-only checks gave false confidence [E3](https://bugbountylibrary.com/r/h1%3A365271.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1838674.md
- E2: https://bugbountylibrary.com/r/h1%3A422944.md
- E3: https://bugbountylibrary.com/r/h1%3A365271.md