11

Our server was exploited by a ransomware. We allow admins to upload PDF, docx, excel etc. But also images and SVG.

And we use dragonfly to generate thumbnails on those files that are supported.

Let's say I upload a infected image to the server.

When resizing images with imagemagick, are the files being executed or just read? Can a resize jeopardize the security of a server?

Improve this question
4
  • Are you asking if image resize CAN be a vector, or if it WAS the vector of your ransomware episode?
    – Mindwin Remember Monica
    Commented Apr 13, 2016 at 19:18
  • 4
    An image isn't an executable file type. What does it even mean to "execute" an image file?
    – Ajedi32
    Commented Apr 13, 2016 at 19:29
  • 5
    @Ajedi32 Evidently you've never heard of piet. In all seriousness though, image files can hide executable code in their metadata..
    – Pharap
    Commented Apr 13, 2016 at 19:33
  • 2
    Do you verify if said files are, really, what they seem to be? If administrators can upload php files, or upload php disguised as something else, then rename it to php, and then retrieve the file from the web, the server may execute the php code. This attack vector seems way more likely to me than a malicious image.
    – Guntram Blohm
    Commented Apr 14, 2016 at 7:07

1 Answer 1

Reset to default
25

Unless you have a bug in your image handling tools code the image gets only read and no code executed which might reside somewhere in the image. But note that in the past there were bugs in image handling code which lead to code execution, for example this bug in libjpeg. Thus to be on the safer side you should do your image manipulation within a restricted environment like some kind of sandbox.

Improve this answer
1
  • 7
    The production servers should only hold production code / verified and safe files/databases. Send/process everything else into another machine (uploads, user-generated files, third-party databases).
    – Mindwin Remember Monica
    Commented Apr 13, 2016 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .