CVE-2022-24720

Description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.877

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-24720 are fixed in Ruby-image_processing 1.12.2	Windows
High-level image processing wrapper for libvips and (USN-6675-1) ruby-image-processing_1.10.3-1ubuntu0.20.04.1_all.deb	Linux
High-level image processing wrapper for libvips and (USN-6675-1) ruby-image-processing_1.10.3-1ubuntu0.22.04.1_all.deb	Linux
ruby-image-processing security update (DSA-5310-1) ruby-image-processing_1.10.3-1+deb11u1_all.deb	Linux
Vulnerabilities CVE-2022-24720 are fixed in Ruby-image_processing for Linux 1.12.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234