Lucene search

[email protected]CVE-2022-24720

HistoryMar 01, 2022 - 11:15 p.m.

CVE-2022-24720

2022-03-0123:15:08

CWE-20

[email protected]

web.nvd.nist.gov

cve-2022-24720

image_processing

libvips

imagemagick

graphicsmagick

active storage

security vulnerability

shell command execution

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.5%

JSON

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Affected configurations

Vulners

NVD

Node

jankoimage_processingRange<1.12.2

CPENameOperatorVersion
image_processing_project:image_processingimage processing project image processinglt1.12.2

CPE	Name	Operator	Version
image_processing_project:image_processing	image processing project image processing	lt	1.12.2

CNA Affected

[
  {
    "vendor": "janko",
    "product": "image_processing",
    "versions": [
      {
        "version": "< 1.12.2",
        "status": "affected"
      }
    ]
  }
]