CVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability
Description
CVE-2016-3715 is a MEDIUM-severity arbitrary file deletion vulnerability in ImageMagick before version 6.9.3-10 and 7.x before 7.0.1-1, carrying a CVSS 3.1 score of 5.5. The vulnerability allows remote attackers to delete arbitrary files on the server by leveraging ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading them. Classified under CWE-552, this flaw is part of the broader "ImageTragick" vulnerability set that affected web applications using ImageMagick for image processing. The attack requires user interaction (processing a crafted image) but no privileges. CISA added CVE-2016-3715 to its KEV catalog on November 3, 2021. The EPSS score of 0.77733 (98.98th percentile) indicates a very high likelihood of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise linux desktop | 6.0; 7.0 |
| redhat | enterprise linux eus | 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux for ibm z systems | 6.0_s390x; 7.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 6.7_s390x; 7.2_s390x; 7.3_s390x; 7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x |
| redhat | enterprise linux for power big endian | 6.0_ppc64; 7.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 6.7_ppc64; 7.2_ppc64; 7.3_ppc64; 7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux for power little endian eus | 7.2_ppc64le; 7.3_ppc64le; 7.4_ppc64le; 7.5_ppc64le; 7.6_ppc64le; 7.7_ppc64le |
| redhat | enterprise linux hpc node | 6.0; 7.0 |
| redhat | enterprise linux hpc node eus | 7.2 |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.2; 7.3; 7.4; 7.6; 7.7 |
| redhat | enterprise linux server from rhui | 6.0; 7.0 |
| redhat | enterprise linux server supplementary eus | 6.7z |
| redhat | enterprise linux server tus | 7.2; 7.3; 7.6; 7.7 |
| redhat | enterprise linux workstation | 6.0; 7.0 |
| imagemagick | imagemagick | < 6.9.3-10; 7.0.0-0; 7.0.1-0 |
| canonical | ubuntu linux | 12.04; 14.04; 15.10; 16.04 |
| oracle | linux | 6; 7 |
| oracle | solaris | 10; 11.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(Broken Link, Patch)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2016-0726.html(Third Party Advisory)
- http://www.debian.org/security/2016/dsa-3580(Mailing List, Third Party Advisory)
- http://www.debian.org/security/2016/dsa-3746(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2016/05/03/18(Mailing List, Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Third Party Advisory)
- http://www.securityfocus.com/archive/1/538378/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/89852(Broken Link, Third Party Advisory, VDB Entry)
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(Mailing List, Third Party Advisory)
- http://www.ubuntu.com/usn/USN-2990-1(Third Party Advisory)
- https://security.gentoo.org/glsa/201611-21(Third Party Advisory)
- https://www.exploit-db.com/exploits/39767/(Exploit, Third Party Advisory, VDB Entry)
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(Exploit, Vendor Advisory)
- https://www.imagemagick.org/script/changelog.php(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3715(US Government Resource)
Weakness Type
CWE-552: Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties occurs when a product makes files or directories accessible to unauthorized actors. This weakness enables attackers to read, modify, or delete files that should not be accessible, potentially exposing sensitive information or disrupting system operations.
In the context of CVE-2016-3715, ImageMagick's ephemeral pseudo protocol provides a mechanism for reading image files and then deleting them after processing. By crafting a malicious image that references the ephemeral protocol with a target file path, an attacker can trick ImageMagick into deleting arbitrary files on the system when the malicious image is processed. This is particularly dangerous in web applications that allow users to upload images that are then processed by ImageMagick on the server, as the file deletion occurs with the privileges of the ImageMagick process.
Learn more: CWE-552 — Files or Directories Accessible to External Parties
Impact Analysis
CVE-2016-3715 carries a CVSS 3.1 score of 5.5 (MEDIUM) with Unchanged Scope.
Confidentiality (NONE): This vulnerability does not directly expose confidential information. The ephemeral protocol deletes files rather than reading and exfiltrating their contents.
Integrity (HIGH): The primary impact is on integrity. Attackers can delete arbitrary files accessible to the ImageMagick process, including application code, configuration files, database files, logs, and other critical system resources. This can corrupt application state and disrupt operations.
Availability (NONE): While file deletion can indirectly impact availability by removing critical system or application files, the CVSS assessment rates direct availability impact as None for this specific vulnerability mechanism.
Scope Unchanged: The impact is confined to the ImageMagick execution context, though this can include any file accessible to the user running ImageMagick.
With an EPSS score of 0.77733 (98.98th percentile), this vulnerability is among the top 1.02% of all CVEs for exploitation likelihood, reflecting the widespread deployment of ImageMagick and the availability of public exploits.
Exploit Maturity
CVE-2016-3715 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is part of the "ImageTragick" vulnerability set disclosed in May 2016, which received significant attention and immediate exploitation attempts. Public exploit code is widely available through Exploit-DB and other sources. The exploit involves crafting a malicious image file that invokes the ephemeral pseudo protocol to target specific files for deletion.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2016-3715. However, the file deletion capability could be used as a destructive component in multi-stage attacks.
Attack surface: ImageMagick is one of the most widely deployed image processing libraries, used by countless web applications, content management systems, and cloud services for server-side image manipulation. Any application that processes user-uploaded images with a vulnerable ImageMagick version is potentially at risk.
KEV deadline: CISA required federal agencies to remediate this vulnerability by May 3, 2022. Despite being disclosed in 2016, many systems remain unpatched due to the ubiquity of ImageMagick in web infrastructure.
Remediation
- Update ImageMagick to version 6.9.3-10 or later (or 7.0.1-1+ for the 7.x branch). Download the latest version from the official ImageMagick website or apply your distribution's security patches. Consult the ImageMagick changelog for details.
- Implement an ImageMagick policy file to disable dangerous coders. Create or modify the ImageMagick policy.xml file to disable the ephemeral, URL, MVG, MSL, and HTTPS coders. This provides defense-in-depth against the entire ImageTragick vulnerability class.
- Validate all uploaded image files before processing. Verify that uploaded files are genuine images using magic byte detection rather than relying on file extensions. Reject files with unexpected content or embedded delegate references.
- Run ImageMagick in a sandboxed environment. Process images in isolated containers or sandboxed environments with minimal filesystem access. Restrict the ImageMagick process to only the directories it needs to read from and write to.
- Audit web applications for ImageMagick usage. Identify all web applications and services in your environment that use ImageMagick for image processing. Prioritize patching for internet-facing applications that process user-uploaded content.
- Consider alternative image processing libraries. For new development, evaluate whether lighter-weight and more secure alternatives such as libvips or Pillow can meet your image processing requirements without the broader attack surface of ImageMagick.
Technical Details
CVE-2016-3715 is a MEDIUM-severity vulnerability in ImageMagick that requires user interaction for exploitation. The attack vector is local (the attacker must provide a malicious image file to be processed), attack complexity is low, no privileges are required, and user interaction is required (someone must process the crafted image).
Technical mechanism: ImageMagick supports various pseudo protocols (also called coders) that extend its functionality beyond simple image file processing. The ephemeral pseudo protocol is designed to read an image file and then delete it afterward. By crafting a malicious image file (such as an MVG or SVG file) that contains a reference to the ephemeral protocol with an arbitrary file path, an attacker can cause ImageMagick to delete any file accessible to the process when the image is processed. For example, a crafted image could contain a reference like "ephemeral:/etc/important-config" which would cause ImageMagick to delete that file.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects a local attack vector requiring user interaction (processing the malicious image) with no privilege requirements. The impact is focused entirely on Integrity (HIGH) since the vulnerability enables file deletion. Confidentiality and Availability are rated None as the exploit specifically deletes files rather than reading or causing denial of service directly.
Frequently Asked Questions
Is CVE-2016-3715 being actively exploited?
Yes, CVE-2016-3715 is part of the ImageTragick vulnerability set and has been actively exploited since its disclosure in May 2016. It is listed in CISA's KEV catalog. The EPSS score of 0.77733 (98.98th percentile) confirms very high exploitation likelihood. Public exploits are widely available.
What products are affected by CVE-2016-3715?
ImageMagick versions before 6.9.3-10 and 7.x versions before 7.0.1-1 are affected. This also impacts downstream distributions including Red Hat Enterprise Linux 6 and 7, Ubuntu 12.04 through 16.04, Oracle Linux, Oracle Solaris, and any application or service that bundles ImageMagick.
How do I fix CVE-2016-3715?
Update ImageMagick to version 6.9.3-10 or later (7.0.1-1+ for the 7.x branch). Additionally, implement a restrictive policy.xml file to disable dangerous pseudo protocols including ephemeral, URL, MVG, and MSL coders. Validate uploaded images before processing and consider running ImageMagick in a sandboxed environment.
How severe is CVE-2016-3715?
CVE-2016-3715 is rated MEDIUM with a CVSS 3.1 score of 5.5. While the base severity is moderate, the practical risk is elevated because ImageMagick is widely deployed in web applications, public exploits are available, and the vulnerability enables deletion of arbitrary files on the server, which can disrupt critical services.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.