Summary
Thumbor's convolution image filter fails to validate a user-supplied column count before using it as a divisor in a C extension, leading to divide-by-zero on certain inputs.
An attacker who can invoke the filter with crafted parameters can reliably crash the Thumbor process on x86_64 systems, causing a remote denial of service.
Affected context
This vulnerability appears when Thumbor instances expose the filters:convolution(<matrix>, <columns>, <should_normalize>) feature and accept user-controlled parameters.
The C extension implementing the filter uses the <columns> value directly as a divisor in modulus and division operations without validating that it is greater than zero.
Deployments that allow arbitrary or loosely validated filter parameters in URLs or templates, especially for untrusted users, are more likely to be affected.
Exploit preconditions
- Attack surface: HTTP(S) interface of Thumbor where image processing URLs can include the
filters:convolutiondirective. - Required access: Ability to send requests that cause Thumbor to evaluate a convolution filter with attacker-controlled
<columns>values (e.g., embedding filters in image URLs). - Trigger point: The C extension
_convolution.cexecutes and uses the provided<columns>value in division/modulus operations. - Why exploitation is possible: The implementation assumes
<columns>is a positive integer and does not enforcecolumns > 0, allowing a zero value to reach arithmetic operations that cause a divide-by-zero trap.
Why this happens
The core issue stems from insufficient input validation on a critical arithmetic parameter in native code.
The filter accepts a <columns> argument derived from user-controlled input and passes it directly into C code implementing the convolution, where it is used as a divisor for % and / operations.
Since the code does not enforce constraints like columns > 0, a zero value leads to undefined behavior and, on x86_64, a SIGFPE signal that terminates the process.
This pattern aligns with CWE-369: Divide By Zero and is facilitated by CWE-20: Improper Input Validation, where assumptions about parameter ranges are not enforced at the boundary.
Potential impact
- Remote attackers can crash the Thumbor worker process by sending crafted image-processing requests.
- Repeated exploitation may cause sustained denial of service for applications relying on dynamic image transformation.
- Service instability can propagate to dependent systems (CDNs, web frontends) that rely on Thumbor for on-the-fly thumbnails.
- In environments without process supervision or auto-restart, crashes can leave image processing unavailable until manual intervention.
General mitigation guidance
Effective mitigation focuses on enforcing strict constraints on numeric parameters and hardening native extensions against invalid input.
Common defensive patterns include:
- Validating filter arguments at the application level, ensuring parameters like
<columns>are positive, non-zero integers before calling native code. - Implementing defensive checks in C extensions to guard against zero or negative divisors and fail fast with clear errors instead of proceeding to arithmetic operations.
- Restricting which filters and parameter ranges are available to untrusted callers, especially for filters that forward inputs into native code.
- Running Thumbor under robust process supervision so crashes are isolated and auto-recovered, reducing the impact of unexpected faults.
- Applying least-privilege principles and rate limiting around expensive or risky transformation endpoints to deter abuse.
How teams detect issues like this
Organizations can detect this class of issue through several complementary approaches:
- Static analysis: Configure rules to flag division or modulus operations in C/C++ code where the divisor originates from external input without explicit range checks (e.g.,
> 0preconditions). - Code review: Pay particular attention to native extensions that accept parameters from higher-level languages, ensuring that all arithmetic-sensitive values are validated at least once at the boundary.
- Runtime monitoring: Instrument Thumbor instances and infrastructure logs to detect recurring SIGFPE signals, sudden worker exits, or spikes in 5xx errors correlated with specific filter usage.
- Policy enforcement: Use automated checks in CI pipelines to ensure new filters or extensions declare and enforce parameter constraints, especially for numeric values involved in loops or divisions.
