Summary
ConvertX versions before 0.18.0 contain a path traversal vulnerability in the ImageMagick conversion workflow. An attacker who can submit conversion requests may use directory traversal sequences in the convert_to parameter to write output outside the intended directory, potentially overwriting container files or causing denial of service.
ConvertX versions before 0.18.0 contain a path traversal vulnerability in the ImageMagick conversion workflow. An attacker who can submit conversion requests may use directory traversal sequences in the convert_to parameter to write output outside the intended directory, potentially overwriting container files or causing denial of service.
Affected context
The issue occurs in ConvertX deployments that use the ImageMagick converter and expose the /convert endpoint. Risk is present when user-controlled convert_to values are incorporated into output paths without sufficient canonicalization and containment checks. Authenticated access is generally required, although deployments configured to allow unauthenticated access may expose the conversion workflow more broadly.
The issue occurs in ConvertX deployments that use the ImageMagick converter and expose the /convert endpoint. Risk is present when user-controlled convert_to values are incorporated into output paths without sufficient canonicalization and containment checks. Authenticated access is generally required, although deployments configured to allow unauthenticated access may expose the conversion workflow more broadly.
Exploit preconditions
- Attack surface: The
/convertfile conversion endpoint - Required access: An authenticated account, or no authentication when unauthenticated access is enabled
- Trigger point: Image conversion involving an extensionless image and a user-controlled
convert_toparameter - Why exploitation is possible: Directory traversal sequences can cause the constructed output path to escape the intended conversion directory
- Attack surface: The
/convertfile conversion endpoint - Required access: An authenticated account, or no authentication when unauthenticated access is enabled
- Trigger point: Image conversion involving an extensionless image and a user-controlled
convert_toparameter - Why exploitation is possible: Directory traversal sequences can cause the constructed output path to escape the intended conversion directory
Why this happens
The vulnerability results from using an unsanitized, user-controlled path component when constructing the destination filename for converted images. Without canonicalizing the resulting path and verifying that it remains within an approved directory, traversal elements can redirect file output to unintended container locations. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with a related CWE-73: External Control of File Name or Path classification.
The vulnerability results from using an unsanitized, user-controlled path component when constructing the destination filename for converted images. Without canonicalizing the resulting path and verifying that it remains within an approved directory, traversal elements can redirect file output to unintended container locations. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with a related CWE-73: External Control of File Name or Path classification.
Potential impact
- An attacker may overwrite files accessible to the service process
- The application or supporting container may become unavailable
- Configuration, runtime, or application data could be damaged
- Conversion output may be written to unintended locations
- Overwritten files could contribute to broader compromise depending on permissions and container configuration
- An attacker may overwrite files accessible to the service process
- The application or supporting container may become unavailable
- Configuration, runtime, or application data could be damaged
- Conversion output may be written to unintended locations
- Overwritten files could contribute to broader compromise depending on permissions and container configuration
General mitigation guidance
Mitigation generally focuses on treating all path components derived from requests as untrusted and enforcing destination containment.
Common defensive patterns include:
- Generate server-side output names rather than accepting arbitrary destination paths
- Canonicalize candidate paths and verify they remain beneath a dedicated output directory
- Reject traversal sequences, absolute paths, and unexpected path separators as an additional validation layer
- Use strict allowlists for permitted conversion formats and output locations
- Run the conversion service with the least filesystem privileges necessary
- Store temporary and converted files in isolated, non-sensitive directories
- Apply filesystem restrictions and container hardening to limit damage from file writes
Mitigation generally focuses on treating all path components derived from requests as untrusted and enforcing destination containment.
Common defensive patterns include:
- Generate server-side output names rather than accepting arbitrary destination paths
- Canonicalize candidate paths and verify they remain beneath a dedicated output directory
- Reject traversal sequences, absolute paths, and unexpected path separators as an additional validation layer
- Use strict allowlists for permitted conversion formats and output locations
- Run the conversion service with the least filesystem privileges necessary
- Store temporary and converted files in isolated, non-sensitive directories
- Apply filesystem restrictions and container hardening to limit damage from file writes
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying request data used in filesystem path construction
- Code review checks for missing canonicalization and directory-containment validation
- Tests covering traversal markers, absolute paths, alternate separators, and encoded path representations
- Web application monitoring for suspicious
convert_tovalues and writes outside expected output directories - Runtime file-integrity monitoring for unexpected modifications in container filesystems
- Policy enforcement requiring dedicated writable directories and non-root service execution
Automated code review and security scanning tools may help identify path construction patterns that lack adequate validation.
Organizations can look for this issue through:
- Static analysis rules identifying request data used in filesystem path construction
- Code review checks for missing canonicalization and directory-containment validation
- Tests covering traversal markers, absolute paths, alternate separators, and encoded path representations
- Web application monitoring for suspicious
convert_tovalues and writes outside expected output directories - Runtime file-integrity monitoring for unexpected modifications in container filesystems
- Policy enforcement requiring dedicated writable directories and non-root service execution
Automated code review and security scanning tools may help identify path construction patterns that lack adequate validation.
