Arbitrary Code Execution Vulnerability in ImageMagick by Vendor ImageMagick
CVE-2024-41817
7.8HIGH
Key Information:
- Vendor
Imagemagick
- Status
- Vendor
- CVE Published:
- 29 July 2024
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2024-41817?
A vulnerability in the AppImage version of ImageMagick can lead to arbitrary code execution, caused by the use of an empty path when setting the MAGICK_CONFIGURE_PATH and LD_LIBRARY_PATH environment variables. This flaw can allow an attacker to load malicious configuration files or shared libraries from the current working directory during the execution of ImageMagick. The issue has been addressed in version 7.11-36, and users are encouraged to upgrade to prevent potential exploitation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.