CVE-2016-3718
published 2016-05-05CVE-2016-3718: The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF)…
PriorityP279medium5.5CVSS 3.1
AVLACLPRNUIRSUCNIHAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
76.90%
99.5th percentile
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Affected
88 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | graphicsmagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| debian | imagemagick | < graphicsmagick 1.3.24-1 (bookworm) | graphicsmagick 1.3.24-1 (bookworm) |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| graphicsmagick | graphicsmagick | >= 0 < 1.3.24-1 | 1.3.24-1 |
| imagemagick | imagemagick | < 6.9.3-10 | 6.9.3-10 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.1 | 8:6.7.7.10-6ubuntu3.1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.1 | 8:6.8.9.9-7ubuntu5.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| oracle | solaris | — | — |
| oracle | solaris | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandpush graphic-context
viewbox 0 0 640 480
fill 'url(http://example.com/)'
pop graphic-context↗
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"fill"; content:"url("; distance:0; nocase; pcre:"/^\s*https?\x3a\/\//Ri"; classtype:web-application-attack; sid:2022791; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3718, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)- →Detect SSRF exploit payloads in MVG files: look for the combination of 'viewbox', 'fill', and 'url(' with an HTTP/FTP scheme in HTTP request bodies uploaded to image-processing endpoints.
- →ImageMagick attempts to guess file type by content, not extension — an MVG SSRF payload can be renamed to .jpg or .png to bypass file-type checks. ↗
- →The 'identify' utility is also vulnerable and can be invoked indirectly via lesspipe.sh, creating additional attack vectors (e.g., via 'less exploit.jpg'). ↗
- →SVG and MVG file formats are the primary vectors for SSRF exploitation; monitor for processing of these formats in image conversion pipelines. ↗
- ·The fix released in ImageMagick 6.9.3-9 (2016-04-30) was incomplete; the fully patched versions are 6.9.3-10 and 7.0.1-1. ↗
- ·On RHEL 5 (will-not-fix), the workaround is to rename the coder shared objects (mvg.so, msl.so, label.so) to disable them, as no patch will be issued. ↗
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv8.4HIGH
vulncheck5.5MEDIUM
cisa5.5MEDIUM
vendor_ubuntu8.4HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ImageMagick up to 6.9.3-9/7.0.1 HTTP/FTP Coder server-side request forgery (USN-2990-1 / EDB-39767)
vuldb·2026-04-23·CVSS 5.5
CVE-2016-3718 [MEDIUM] ImageMagick up to 6.9.3-9/7.0.1 HTTP/FTP Coder server-side request forgery (USN-2990-1 / EDB-39767)
A vulnerability was found in ImageMagick up to 6.9.3-9/7.0.1. It has been declared as problematic. This affects an unknown function of the component HTTP/FTP Coder. Executing a manipulation can lead to server-side request forgery.
This vulnerability is registered as CVE-2016-3718. The attack needs to be launched locally. Furthermore, an exploit is available.
It is recommended to upgrade the affected component.
GHSA
GHSA-q994-gg9f-3g56: The (1) HTTP and (2) FTP coders in ImageMagick before 6
ghsa_unreviewed·2022-05-14
CVE-2016-3718 [MEDIUM] CWE-20 GHSA-q994-gg9f-3g56: The (1) HTTP and (2) FTP coders in ImageMagick before 6
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
OSV
imagemagick vulnerabilities
osv·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] imagemagick vulnerabilities
imagemagick vulnerabilities
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
OSV
CVE-2016-3718: The (1) HTTP and (2) FTP coders in ImageMagick before 6
osv·2016-05-05·CVSS 5.5
CVE-2016-3718 [MEDIUM] CVE-2016-3718: The (1) HTTP and (2) FTP coders in ImageMagick before 6
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
VulnCheck
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
vulncheck·2016·CVSS 5.5
CVE-2016-3718 [MEDIUM] CWE-20 ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
Affected: ImageMagick ImageMagick
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-03
CISA
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
cisa·2021-11-03·CVSS 5.5
CVE-2016-3718 [MEDIUM] CWE-20 ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Affected: ImageMagick ImageMagick
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-3718
Remediation Due Date: 2022-05-03
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2016-06-02·CVSS 8.4
CVE-2016-3714 [HIGH] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly
sanitized untrusted input. A remote attacker could use these issues to
execute arbitrary code. These issues are known as "ImageTragick". This
update disables problematic coders via the /etc/ImageMagick-6/policy.xml
configuration file. In certain environments the coders may need to be
manually re-enabled after making sure that ImageMagick does not process
untrusted input. (CVE-2016-3714, CVE-2016-3715, CVE-2016-3716,
CVE-2016-3717, CVE-2016-3718)
Bob Friesenhahn discovered that ImageMagick allowed injecting commands via
an image file or filename. A remote attacker could use this issue to
execute arbitrary code. (CVE-2016-5118)
Red Hat
ImageMagick: SSRF vulnerability
vendor_redhat·2016-05-03·CVSS 5.5
CVE-2016-3718 [MEDIUM] CWE-352 ImageMagick: SSRF vulnerability
ImageMagick: SSRF vulnerability
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTP(S) requests or opening FTP sessions via specially crafted images.
Mitigation: Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071
Red Hat Enterprise Linux 6 and 7
As a workaround the /etc/ImageMagick/policy.xml file can be edited to disable processing
Debian
CVE-2016-3718: graphicsmagick - The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7....
vendor_debian·2016·CVSS 5.5
CVE-2016-3718 [MEDIUM] CVE-2016-3718: graphicsmagick - The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7....
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Scope: local
bookworm: resolved (fixed in 1.3.24-1)
bullseye: resolved (fixed in 1.3.24-1)
forky: resolved (fixed in 1.3.24-1)
sid: resolved (fixed in 1.3.24-1)
trixie: resolved (fixed in 1.3.24-1)
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)
suricata·2016-05-04·CVSS 5.5
CVE-2016-3718 [MEDIUM] ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)
ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"fill"; content:"url("; distance:0; nocase; pcre:"/^\s*https?\x3a\/\//Ri"; classtype:web-application-attack; sid:2022791; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3718, signature_severity Major, tag CISA_KEV, updated_at 2020_10_06;)
Bugzilla
CVE-2016-3718 ImageMagick: SSRF vulnerability [fedora-all]
bugzilla·2016-05-04·CVSS 5.5
CVE-2016-3718 [MEDIUM] CVE-2016-3718 ImageMagick: SSRF vulnerability [fedora-all]
CVE-2016-3718 ImageMagick: SSRF vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
Bugzilla
CVE-2016-3718 ImageMagick: SSRF vulnerability
bugzilla·2016-05-04·CVSS 5.5
CVE-2016-3718 [MEDIUM] CVE-2016-3718 ImageMagick: SSRF vulnerability
CVE-2016-3718 ImageMagick: SSRF vulnerability
A vulnerability was found in ImageMagick. It is possible to force a HTTP, GET or FTP request from user via a crafted .mvg file.
Discussion:
Created ImageMagick tracking bugs for this issue:
Affects: fedora-all [bug 1332804]
---
Mitigation:
Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071
Red Hat Enterprise Linux 6 and 7
As a workaround the /etc/ImageMagick/policy.xml file can be edited to disable processing of MVG, HTTPS, HTTP, URL, FTP, EPHEMERAL, MSL, LABEL, TEXT,
SHOW, WIN and PLT commands within image files, simply add the following lines:
within the policy map stanza:
...
Red Hat Enterprise Linux 5
In the following folders:
/usr/lib64/ImageMagick-6.2.8/modules-Q16/code
http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlhttps://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttp://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLoghttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0726.htmlhttp://www.debian.org/security/2016/dsa-3580http://www.openwall.com/lists/oss-security/2016/05/03/18http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/archive/1/538378/100/0/threadedhttp://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568http://www.ubuntu.com/usn/USN-2990-1https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlhttps://security.gentoo.org/glsa/201611-21https://www.exploit-db.com/exploits/39767/https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588https://www.imagemagick.org/script/changelog.phphttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718
2016-05-05
Published
2021-11-03
Added to CISA KEV
Exploited in the wild