CVE-2022-24720: Image processing Remote Shell Execution Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-cxf7-qrc5-9446
Share
CVSS 9.8
CWE-78 CWE-20
Published
Advisory Summary

CVE-2022-24720 is a CRITICAL (CVSS 9.8) remote shell execution vulnerability vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) affecting Image processing libraries in the RubyGems ecosystem. The issue involves remote shell execution vulnerability in image_processing. Remediation is available by upgrading affected packages to version 1.12.2.

CVE-2022-24720 at a Glance

CVE Identifier CVE-2022-24720
GHSA Identifier GHSA-cxf7-qrc5-9446
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Product Image processing
Package Ecosystem RubyGems
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2022-24720

To remediate this vulnerability, upgrade all affected Image processing dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

image_processing fixed: 1.12.2 
Upgrade image_processing to 1.12.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for image_processing

How to Check if You Are Affected

To determine whether your application is affected by CVE-2022-24720, inspect your project dependencies for Image processing:

inspect dependencies for image_processing

Analyze the terminal output to locate any version of Image processing in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.12.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), where the product constructs all or part of an os command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended os command when it is sent to a downstream component. In Image processing, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands: ```rb ImageProcessing::Vips.apply({ system: "echo EXECUTED" }) #>> EXECUTED ``` This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. ### Patches The vulnerability has been fixed in version 1.12.2 of image_processing. ### Workarounds If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example: ```rb operations = params[:operations] .map { |operation| [operation[:name], *operation[:value]] } .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization ImageProcessing::Vips.apply(operations) ```

CVE-2022-24720 Affected Image processing Versions

1 component(s)
Fixed Versions:
1.12.2
Product / Package Ecosystem Affected Versions Fixed Version
image_processing
gem/image_processing
RubyGems
< 1.12.2
1.12.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446
NVD — CVE-2022-24720 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24720
Security Fix Commit FIX COMMIT
https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada
Image processing Source Repository REPOSITORY
https://github.com/janko/image_processing
Image processing Source Repository REPOSITORY
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/image_processing/CVE-2022-24720.yml
Image processing Security Information SECURITY
https://www.debian.org/security/2022/dsa-5310

Frequently Asked Questions

What is CVE-2022-24720?
CVE-2022-24720 is a security vulnerability in Image processing involving Remote shell execution vulnerability in image_processing under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
Which Image processing versions are affected?
Affected versions include releases prior to 1.12.2 across affected packages: image_processing.
What version fixes CVE-2022-24720?
Upgrading to 1.12.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is image_processing affected?
Yes, image_processing is affected in releases prior to 1.12.2. Upgrade your dependency to 1.12.2 or later.
What is the CVSS score of CVE-2022-24720?
CVE-2022-24720 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2022-24720?
CVE-2022-24720 is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.).
How can I check RubyGems dependencies for CVE-2022-24720?
Run the dependency tree command: 'inspect dependencies for image_processing'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cxf7-qrc5-9446",
  "modified" : "2022-03-10T15:56:28Z",
  "published" : "2022-03-01T22:22:26Z",
  "aliases" : [ "CVE-2022-24720" ],
  "summary" : "Remote shell execution vulnerability in image_processing",
  "details" : "### Impact\n\nWhen using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:\n\n```rb\nImageProcessing::Vips.apply({ system: \"echo EXECUTED\" })\n#>> EXECUTED\n```\n\nThis method is called internally by Active Storage variants, so Active Storage is vulnerable as well.\n\n### Patches\n\nThe vulnerability has been fixed in version 1.12.2 of image_processing.\n\n### Workarounds\n\nIf you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:\n\n```rb\noperations = params[:operations]\n  .map { |operation| [operation[:name], *operation[:value]] }\n  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization\n\nImageProcessing::Vips.apply(operations)\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "image_processing"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.12.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-24720"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/janko/image_processing"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/image_processing/CVE-2022-24720.yml"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2022/dsa-5310"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-78" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-03-01T22:22:26Z",
    "nvd_published_at" : "2022-03-01T23:15:00Z"
  }
}