ImageMagick

Imagine someone uploading a photo to your WordPress site.

If it came off an iPhone, it may be a HEIC or H-E-I-C file, and on many servers, WordPress passes that file through imagick and ImageMagick to a system library called libheif.

Our research team found a critical flaw in that library using Wordfence Argus, our own adversarial testing tool.

A specially crafted HEIC file can make it write attacker-chosen data into adjacent memory.

We tested nine real setups, and the official WordPress docker image was vulnerable straight out of the box, along with Debian thirteen, Ubuntu twenty-six point O four, and Fedora forty-four.

Wordfence hasn't seen evidence that this specific flaw has been exploited in the wild yet, but researchers at cybersecurity company Hacktron successfully exploited other similar libheif bugs earlier this year, and they say it took them a day or two to adapt an attack to each new target.

So what should you do? On your WordPress site, go to tools, site health, info, media handling, and see whether ImageMagick lists H-E-I-C.

If it does, install your operating system's fixed libheif package, then restart PHP and the other web services that use it, so they stop holding the old library.

But at least as I know it, like, it, they're now e- they exceed Adobe in terms of scriptability, and that can put...

And, and, and they're on the CLI, which means that now, you know, if you, if you had to use, like, ImageMagick or one of those sort of things, now you can just download this Rust CLI, and basically you have all of Photoshop really at your fingertips to do anything that you want in scriptable AI, which is pretty intense actually.

Yeah.

It's t- it's, the thing that's been interesting to me with it comes, 'cause I do a good amount of stuff with images, and it's crazy how much stuff now my image editor has become ChatGPT, just because it's-

I think this bit me a, a number of years ago.

I think ImageMagick needed a specific library that package update kept replacing, and so I put this thing in there, um, a while ago.

And then down the line I was like, "Why do I have all [laughs] this stuff here?" Um, and I think it was just one release of it, and so once I upgraded that, that stopped needing those old, um, libraries and I got rid of it.

But he's right, like, it's one of those settings that once you've set it, you forget it, and then it just accumulates.

Like, don't just generate a bunch of things and then just shooting it over the wall.

Like, I, I, I mean, years ago the people used to do that with fuzzing, right? They, they'd fuzz, like, ImageMagick or something like that, and then give us a, a tarball of all these fuzzed files and be like, "Hey, we think there's some problems here." Like, "Thanks, could you please point them out to me?" Like, don't just give me a million fuzzer files of, of random input and then, like, some of them crash and some of them don't.

Like, you got to weed through some of the stuff yourself first, right? So the, the notion of, like, test it first, like, actually be able to reproduce it, make sure it's valid, um, is really good, particularly since I think a lot of people are using AI tools, uh, and this is my hypothesis.

A lot of people are using AI tools right now to, uh, submit bugs to bug bounty programs and get their-

It's actually the default image format used on Mac devices.

Ironically, LibHive is used in this tool called ImageMagick, which is a tool used for resizing and unresizing and moving around images.

The text in the XKCD comic literally says, title text, someday ImageMagick will finally break for good and we'll have a long period of scrambling as we try to reassemble civilization from the rubble.

Open AI was compromised because of vulnerability in LibHive, which compromised image magic, which compromised discourse, okay? We're talking about the world of software security, right? Is software getting more secure? Is the buffer overflow finally going to go away? Unfortunately, no.

The bug we're talking about today is, what is this, a heap overflow in libhife.

So, you know, we don't have a ton of the details on exactly which bug, but there was basically a heap buffer overflow that led to an out-of-bounds read-write in the process of decoding a hike image, which is a format parsed by libhife, So that if you ask ImageMagick to resize this malicious image, it will give you an arbitrary read-write in the context of the process.

So what Hacktron was able to do was use that to land a shell on the OpenAI community forms.

Okay, so there's community to OpenAI, which is run on the stack called Discourse.

To be fair, it was Hash not only OpenAI on this one.

Quote, Harsh Jeswal, We're disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.

It was literally XKCD number 2347, one obscure image library beneath a huge number of apps.

End quote.

Harsh Jaiswal.

We're disclosing Heif Heist, a months-long investigation into Lebheif that allowed us to hack OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick, and many more.

It was literally XKCD number 2347, one obscure image library beneath a huge number of apps.

These were white hat hackers who took pains to avoid exposing the underlying information while proving they could have gotten that information.