CVE-2023-1289

Vulnerability in Magick.NET-Q16-AnyCPU (CVE-2023-1289)

Summary

Vulnerability in Magick.NET-Q16-AnyCPU (CVE-2023-1289). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 13.0.0 or later.

Original description

The description as published by the source.

Summary

Specially crafted SVG file make segmentation fault and generate trash files in "/tmp", possible to leverage DoS.

Operating system, version and so on

Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara)

Tested ImageMagick version

6.9.11-60, 7.1.0-62

Details

A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.

It seems that this error affects a lot of websites and causes a generating trash files in /tmp when uploading this PC file to the server.

I think it's better to check the file descriptor coming from itself before executing read().

PoC

Generate SVG file:

<!DOCTYPE test>

Run some commands for verification:

$./magick --version
Version: ImageMagick 7.1.0-62 Q16-HDRI x86_64 74b3683a4:20230211 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.5) 
Delegates (built-in): bzlib djvu fontconfig freetype jbig jng jpeg lcms lqr lzma openexr png raqm tiff webp x xml zlib
Compiler: gcc (7.5)
$./magick convert -verbose -font OpenSymbol bad.svg t.jpg
'inkscape' '/tmp/magick-ixX13JwrwrLUhyucKsGxechsQtEN4Zji' --export-filename='/tmp/magick-qp154V6U-dyAwtU-QbcnWD8XKFcG7q5k.png' --export-dpi='96' --export-background='rgb(1…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2023-1289 has been found in Magick.NET-Q16-AnyCPU.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Magick.NET-Q16-AnyCPU to 13.0.0 or later.
If unsure, ask your IT team or search "Magick.NET-Q16-AnyCPU CVE-2023-1289" on the vendor's site.

CVE-2023-1289 (Magick.NET-Q16-AnyCPU) — CWE-20
Attack vector: local / unauthenticated
Patched: 13.0.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-20) exists in Magick.NET-Q16-AnyCPU.

📍 Affected scope

Check the vendor advisory for the affected versions of Magick.NET-Q16-AnyCPU.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 13.0.0.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Magick.NET-Q16-AnyCPU' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'Magick.NET-Q16-AnyCPU' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Magick.NET-Q16-AnyCPU を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade Magick.NET-Q16-AnyCPU to 13.0.0
```
ステージング環境で 13.0.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。