Summary
A command injection vulnerability in orbitale imagemagick-php affects the font-handling functionality in src/Command.php. When attacker-controlled font file input reaches the vulnerable command construction path, a remote attacker may influence operating-system command execution, depending on how the application exposes this functionality.
A command injection vulnerability in orbitale imagemagick-php affects the font-handling functionality in src/Command.php. When attacker-controlled font file input reaches the vulnerable command construction path, a remote attacker may influence operating-system command execution, depending on how the application exposes this functionality.
Affected context
The issue may affect imagemagick-php deployments using versions up to 3.3.5 when the Command::font function processes font file values from an externally reachable application interface. Risk depends on whether untrusted users can supply or influence the fontFile argument and whether the application invokes ImageMagick operations with the host process's operating-system privileges.
The issue may affect imagemagick-php deployments using versions up to 3.3.5 when the Command::font function processes font file values from an externally reachable application interface. Risk depends on whether untrusted users can supply or influence the fontFile argument and whether the application invokes ImageMagick operations with the host process's operating-system privileges.
Exploit preconditions
- Attack surface: An application interface or service that exposes font-related imagemagick-php functionality
- Required access: The ability to submit or influence the
fontFileargument, potentially without prior authentication if the surrounding interface permits it - Trigger point: Processing the supplied value through
Command::fontinsrc/Command.php - Why exploitation is possible: The input may be incorporated into an operating-system command without sufficient separation between data and command syntax
- Attack surface: An application interface or service that exposes font-related imagemagick-php functionality
- Required access: The ability to submit or influence the
fontFileargument, potentially without prior authentication if the surrounding interface permits it - Trigger point: Processing the supplied value through
Command::fontinsrc/Command.php - Why exploitation is possible: The input may be incorporated into an operating-system command without sufficient separation between data and command syntax
Why this happens
The vulnerability is caused by unsafe construction or invocation of an operating-system command using attacker-influenced font file data. If the value is concatenated into a shell command or passed through an interpreter without robust argument separation, command metacharacters may alter the intended operation. This maps primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command, with CWE-77: Improper Neutralization of Special Elements in Command describing the broader command-injection class.
The vulnerability is caused by unsafe construction or invocation of an operating-system command using attacker-influenced font file data. If the value is concatenated into a shell command or passed through an interpreter without robust argument separation, command metacharacters may alter the intended operation. This maps primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command, with CWE-77: Improper Neutralization of Special Elements in Command describing the broader command-injection class.
Potential impact
- An attacker may execute arbitrary commands with the privileges of the application process
- The application host may be compromised
- Confidential files or environment-held credentials could be accessed
- Application data may be modified, deleted, or exfiltrated
- The vulnerable service could be used to access other systems or services
- An attacker may execute arbitrary commands with the privileges of the application process
- The application host may be compromised
- Confidential files or environment-held credentials could be accessed
- Application data may be modified, deleted, or exfiltrated
- The vulnerable service could be used to access other systems or services
General mitigation guidance
Mitigation generally focuses on ensuring that font file values remain data rather than command syntax.
Common defensive patterns include:
- Prefer direct library or process APIs that pass arguments as separate values without invoking a shell
- Use strict allowlists for permitted font paths, names, and formats
- Reduce input trust by resolving files from controlled directories rather than accepting arbitrary paths
- Apply canonicalization and validation before use, while avoiding validation as the sole defense
- Run image-processing workers with minimal filesystem, network, and operating-system privileges
- Isolate processing workloads and restrict access to secrets and sensitive host resources
Mitigation generally focuses on ensuring that font file values remain data rather than command syntax.
Common defensive patterns include:
- Prefer direct library or process APIs that pass arguments as separate values without invoking a shell
- Use strict allowlists for permitted font paths, names, and formats
- Reduce input trust by resolving files from controlled directories rather than accepting arbitrary paths
- Apply canonicalization and validation before use, while avoiding validation as the sole defense
- Run image-processing workers with minimal filesystem, network, and operating-system privileges
- Isolate processing workloads and restrict access to secrets and sensitive host resources
How teams detect issues like this
Organizations can look for command-injection risks through:
- Static analysis rules identifying shell execution, command concatenation, or interpreter invocation near
fontFileand similar inputs - Code review checks for user-controlled values passed to process-spawning functions
- Searches for shell metacharacter handling, string-based command assembly, and missing argument arrays
- Runtime monitoring for unexpected child processes, command interpreters, or unusual ImageMagick process behavior
- Application logs and policy controls that flag unexpected font paths or image-processing requests
Automated code-review and software-composition tools may help identify related unsafe command-execution patterns.
Organizations can look for command-injection risks through:
- Static analysis rules identifying shell execution, command concatenation, or interpreter invocation near
fontFileand similar inputs - Code review checks for user-controlled values passed to process-spawning functions
- Searches for shell metacharacter handling, string-based command assembly, and missing argument arrays
- Runtime monitoring for unexpected child processes, command interpreters, or unusual ImageMagick process behavior
- Application logs and policy controls that flag unexpected font paths or image-processing requests
Automated code-review and software-composition tools may help identify related unsafe command-execution patterns.
Sources
| Source | Link |
|---|---|
| gist. | gist.github.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
