CWE-20: Improper Input Validation - CVE-2016-3714

According to the researchers in a mailing list post:

Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats.

ImageMagick allows to process files with external libraries. This feature is called 'delegate'. It is implemented as a system() with command string ('command') from the config file delegates.xml with actual value for different params (input/output filenames etc). Due to insufficient %M param filtering it is possible to conduct shell command injection.

An unauthenticated remote attacker that can upload crafted image files may be able to execute arbitrary code in the context of the user calling ImageMagick.

Apply an Update

ImageMagick version 6.9.3-10 and 7.0.1-1 have been released to address these issues. Affected users should update to the latest version of ImageMagick as soon as possible.

However, affected users may also apply the following mitigations:

Verify Files and Disable Vulnerable Filters

The researchers suggest that this vulnerability may be mitigated by doing the following:

1. Verify that all image files begin with the expected "magic bytes" corresponding to the image file types you support before sending them to ImageMagick for processing.
2. Use a policy file to disable the vulnerable ImageMagick coders.

For more details, please see https://imagetragick.com/