CVE-2017-15277
MEDIUMGraphicsMagick 1.3.26 - Exposure of Sensitive Information via Uninitialized GIF Palette
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2017-15277. PoCs published by hexrom.
AI-analyzed exploit summary This PoC exploits CVE-2017-15277 in ImageMagick by leveraging a crafted GIF file to trigger arbitrary file deletion via a delegate function. The attack involves social engineering to lure a victim into processing a malicious image.
Description
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
Exploits (3)
This PoC exploits CVE-2017-15277 in ImageMagick by leveraging a crafted GIF file to trigger arbitrary file deletion via a delegate function. The attack involves social engineering to lure a victim into processing a malicious image.
This repository contains a functional PoC for CVE-2017-15277, an SSRF vulnerability in ImageMagick. The exploit leverages crafted URLs and metadata in GIF files to force the server to make arbitrary HTTP requests, potentially leading to information disclosure or further exploitation.
This repository contains a functional PoC for CVE-2017-15277, an ImageMagick vulnerability involving improper handling of GIF files. The exploit leverages a crafted GIF file and a chain of PHP scripts to trigger remote code execution via a server-side request forgery (SSRF) attack.
References (9)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N