Top 10 winner

ImageMagick - Shell injection via PDF password

ImageMagick puts the -authenticate value straight into the Ghostscript command line inside double quotes, so a password containing a quote and a shell metacharacter closes the argument and runs commands. The parameter is reachable from a file via the MSL coder, and an SVG and MSL polyglot turns an image upload into remote code execution.

In the archive

• Ranked #8 in the 2020 Top 10 Web Hacking Techniques

Related sources

• Author disclosure discussion

Tags

• command-injection
• rce
• file-upload
• pdf
• lfi
• filter-bypass
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.