Title: ImageMagick Vulnerability Information Author: Joe Hoyle Published: May 6, 2016 --- [ ](https://profiles.wordpress.org/joehoyle/) [Joe Hoyle](https://profiles.wordpress.org/joehoyle/) 1:32 pm _on_ May 6, 2016 Tags: imagick, [security ( 18 )](https://make.wordpress.org/core/tag/security/) # ImageMagick Vulnerability Information A few days ago an ImageMagick vulnerability was disclosed dubbed “[ImageTragick](https://imagetragick.com/)” that affects WordPress websites whose host has ImageMagick installed. If you control your own hosting for your WordPress site, you should look to implement the following fix(es) immediately. The full effect of this issue is still unfolding and it’s not clear what the full impact will be; however, there are mitigation steps that should keep you safe with the known exploits so far. This vulnerability is already being exploited in the wild, and proof of concepts are being published. ### How is WordPress affected? Uploaded images to the WordPress adminadmin (and super admin) that contain malicious data can perform a number of exploits via the underlying ImageMagick library. Uploads are available to all users who have the `upload_files` capabilitycapability A ** capability** is permission to perform one or more types of task. Checking if a user has a capability is performed by the `current_user_can` function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability).. By default that’s authors, editors, and administrators; contributors, subscribers, and anonymous users do not have that capability. This issue is still developing; however, it should be noted that if un-patched, this exploit allows for Remote Code Execution (RCE). ### What steps is the WordPress CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. Team taking to mitigate this? The exploit is in the Imagick PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher extension, not WordPress itself (or any library that is shipped with WordPress). The WordPress Security Team is exploring ways to help mitigate this exploit due to the wide usage of ImageMagick in the WordPress ecosystem; however, this exploit is best handled at the hosting level (instructions below). ### How do I know if my site is vulnerable? If you do not control your own hosting environment then it’s likely that your host is taking steps to fix the issue. We recommend you reach out to your hosting provider to verify they are handling the “ImageTragick (CVE-2016-3714, CVE-2016-3718 and CVE-2016-3715)” exploit. Only WordPress sites that have the PHP Imagick extension installed are vulnerable to this exploit. If you don’t know if your server has this PHP extension, there are a few ways to identify this: 1. Inspect the output of the `phpinfo()` function for “Imagick”. 2. Run `php -m | grep imagick` on the command line. ### How do I patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a **diff**. A patch can be _applied_ to a codebase for testing. the vulnerability? Currently the best known fix is to add a `policy.xml` file to your ImageMagick installation to limit the delegates that ImageMagick will use. Due to the ongoing nature of this issue, we recommend you refer to and follow [https://imagetragick.com/](https://imagetragick.com/) for instructions on how to handle the problem. ### ImageMagick 6.9.3-10 ImageMagick released an update on 2016-05-03 to fix this issue; however, there are questions around whether this update provides a complete fix. At the time of writing it should be presumed version 6.9.3-10 does not fix the issues completely and you should take steps to patch the issue via the `policy.xml` file. ### Further reading More information and updates on this exploit can be found at [https://imagetragick.com/](https://imagetragick.com/). We recommend you keep an eye out for updates to this issue, as the full extent of problem is still being discovered. Documentation on the `policy.xml` file can be found at [https://www.imagemagick.org/script/resources.php](https://www.imagemagick.org/script/resources.php). [#imagick](https://make.wordpress.org/core/tag/imagick/), [#security](https://make.wordpress.org/core/tag/security/) ### Share this: * [ Threads ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=threads) * [ Mastodon ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=bluesky) * [ X ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=x) * [ Facebook ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/?share=linkedin) 1. ![](https://secure.gravatar.com/avatar/ab7afecbc5649954e8ab2a88593cccc3b69966ea46c6ad22d51be38ecf9d23c1? s=32&d=mm&r=g) 2. [Brad Touesnard](https://profiles.wordpress.org/bradt/) 7:11 pm _on_ May 6, 2016 3. I just thought of another way WordPress sites might be affected. If your WordPress site is automatically pulling in public images and adding them to the Media Library. For example, your site may be pulling all tweets with a certain hashtag and loading the images into the Media Library. An attacker might be able to place an image to be pulled in. 4. * ![](https://secure.gravatar.com/avatar/20fb83a658108493c61b36a41b717e30e4447b782306b3ef10dfea72d5d5b29c? s=32&d=mm&r=g) * [Jeff Chandler](https://profiles.wordpress.org/jeffr0/) 7:52 pm _on_ May 6, 2016 * This also occurs if someone is using PressThis to publish an article as it takes the image from the post and uploads it into the media library to avoid hotlinking. 5. ![](https://secure.gravatar.com/avatar/f38676be97b8d7ee8c454d9c32aff580948400109f6ca16262ecb498ee1f81ef? s=32&d=mm&r=g) 6. [Maeve Lander](https://profiles.wordpress.org/enigmaweb/) 5:13 am _on_ May 9, 2016 7. In case it’s helpful… [https://github.com/EnigmaWeb/imagemagickcheck](https://github.com/EnigmaWeb/imagemagickcheck) 8. ![](https://secure.gravatar.com/avatar/8237715bfee9af01e7244d5423f2a99b90a664255c7438385ac3e0f5489d25f4? s=32&d=mm&r=g) 9. [wgroenewold](https://profiles.wordpress.org/wgroenewold/) 6:45 am _on_ May 31, 2016 10. ImageMagick is also shipped with e.g. NextGen Gallery. 11. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 2:47 am _on_ June 3, 2016 * Not in [https://wordpress.org/plugins/nextgen-gallery/](https://wordpress.org/plugins/nextgen-gallery/) it’s not. * We’re talking about the server package anyway. Comments are closed. # Post navigation [← Dev Chat Summary – May 4, 2016](https://make.wordpress.org/core/2016/05/05/dev-chat-summary-may-4-2016/) [This Week in 4.6: May 9 – May 15 →](https://make.wordpress.org/core/2016/05/09/this-week-in-4-6-may-9-may-15/)