CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2016-3718 is a MEDIUM-severity Server-Side Request Forgery (SSRF) vulnerability in ImageMagick before version 6.9.3-10 and 7.x before 7.0.1-1, carrying a CVSS 3.1 score of 5.5. The vulnerability allows remote attackers to conduct SSRF attacks via crafted images that trigger the HTTP or FTP coders to make requests to arbitrary servers from the ImageMagick process. Classified under CWE-918, this flaw is part of the "ImageTragick" vulnerability set. The attack requires user interaction (processing a crafted image) but no privileges. CISA added CVE-2016-3718 to its KEV catalog on November 3, 2021. The EPSS score of 0.83834 (99.28th percentile) indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise linux desktop | 6.0; 7.0 |
| redhat | enterprise linux eus | 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux for ibm z systems | 6.0_s390x; 7.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 6.7_s390x; 7.2_s390x; 7.3_s390x; 7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x |
| redhat | enterprise linux for power big endian | 6.0_ppc64; 7.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 6.7_ppc64; 7.2_ppc64; 7.3_ppc64; 7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux for power little endian eus | 7.2_ppc64le; 7.3_ppc64le; 7.4_ppc64le; 7.5_ppc64le; 7.6_ppc64le; 7.7_ppc64le |
| redhat | enterprise linux hpc node | 6.0; 7.0 |
| redhat | enterprise linux hpc node eus | 7.2 |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.2; 7.3; 7.4; 7.6; 7.7 |
| redhat | enterprise linux server from rhui | 6.0; 7.0 |
| redhat | enterprise linux server supplementary eus | 6.7z |
| redhat | enterprise linux server tus | 7.2; 7.3; 7.6; 7.7 |
| redhat | enterprise linux workstation | 6.0; 7.0 |
| imagemagick | imagemagick | < 6.9.3-10; 7.0.0-0; 7.0.1-0 |
| canonical | ubuntu linux | 12.04; 14.04; 15.10; 16.04 |
| oracle | linux | 6; 7 |
| oracle | solaris | 10; 11.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog(Patch, Vendor Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2016-0726.html(Third Party Advisory)
- http://www.debian.org/security/2016/dsa-3580(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2016/05/03/18(Mailing List, Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Third Party Advisory)
- http://www.securityfocus.com/archive/1/538378/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568(Third Party Advisory)
- http://www.ubuntu.com/usn/USN-2990-1(Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/201611-21(Third Party Advisory)
- https://www.exploit-db.com/exploits/39767/(Third Party Advisory, VDB Entry)
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588(Vendor Advisory)
- https://www.imagemagick.org/script/changelog.php(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when a web application fetches a remote resource without validating the user-supplied URL. This allows attackers to coerce the application into sending requests to unexpected destinations, even when protected by firewalls, VPNs, or network access control lists. Attackers can abuse SSRF to access internal services, cloud metadata endpoints, read local files, port scan internal networks, or interact with internal APIs.
In the context of CVE-2016-3718, ImageMagick's HTTP and FTP coders can be triggered through crafted image files to make outbound network requests to attacker-specified servers. When a web application processes a malicious image uploaded by an attacker, ImageMagick initiates server-side HTTP or FTP requests from the server to arbitrary destinations. This allows attackers to probe internal networks, access internal services not exposed to the internet, read cloud metadata endpoints containing credentials, and potentially exfiltrate data through DNS or HTTP callbacks.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2016-3718 carries a CVSS 3.1 score of 5.5 (MEDIUM) with Unchanged Scope.
Confidentiality (NONE): The CVSS assessment rates confidentiality impact as None for the base score. However, in practice, SSRF can be leveraged to access internal services and cloud metadata endpoints that expose sensitive information including credentials, API keys, and configuration data.
Integrity (HIGH): The primary CVSS impact is on integrity. The SSRF capability allows the attacker to forge requests from the server, potentially interacting with internal APIs and services in ways that modify data or configurations. The server effectively becomes a proxy for the attacker's requests.
Availability (NONE): Direct availability impact is rated None, though SSRF attacks can indirectly cause availability issues through resource exhaustion or by triggering actions on internal services.
Scope Unchanged: The vulnerability impact is contained within the ImageMagick processing context, though the SSRF capability can reach other internal services accessible from the host.
With an EPSS score of 0.83834 (99.28th percentile), this vulnerability ranks among the top 0.72% of all CVEs for exploitation probability.
Exploit Maturity
CVE-2016-3718 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is part of the ImageTragick vulnerability set disclosed in May 2016. Public exploit code is available through Exploit-DB and security research publications. The exploit involves crafting image files that trigger ImageMagick's HTTP or FTP coders to make requests to attacker-controlled or internal servers.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2016-3718. However, SSRF vulnerabilities are frequently used in attack chains to gather intelligence about internal networks and access additional services.
Attack surface: Like other ImageTragick vulnerabilities, CVE-2016-3718 affects any application that processes user-supplied images with vulnerable ImageMagick versions. Web applications with image upload functionality, content management systems, and cloud-based image processing services are primary targets.
KEV deadline: CISA required federal agencies to remediate this vulnerability by May 3, 2022. The high EPSS score of 0.83834 (99.28th percentile) confirms ongoing exploitation interest.
Remediation
- Update ImageMagick to version 6.9.3-10 or later (or 7.0.1-1+ for the 7.x branch). Download the latest version from the official ImageMagick website or apply your distribution's security patches. Consult the ImageMagick changelog for details.
- Disable HTTP and FTP coders in ImageMagick's policy file. Add policy rules to the ImageMagick policy.xml file that disable the HTTP, HTTPS, FTP, and other network-related coders. This prevents ImageMagick from making outbound network requests regardless of the input image content.
- Implement network egress filtering. Configure firewall rules to restrict outbound network connections from servers running ImageMagick. Only allow connections to required external services and block access to internal network ranges and cloud metadata endpoints.
- Validate and sanitize uploaded images. Verify uploaded file types using magic bytes and strip any embedded metadata or references before processing. Consider converting all uploaded images to a safe format before ImageMagick processing.
- Run ImageMagick in a sandboxed environment with restricted networking. Deploy image processing in isolated containers with no network access or with strict network policies that prevent connections to internal services.
- Monitor for SSRF indicators. Implement network monitoring to detect unusual outbound connections from application servers, particularly to internal services, cloud metadata endpoints (169.254.169.254), or unknown external hosts.
Technical Details
CVE-2016-3718 is a MEDIUM-severity vulnerability in ImageMagick that requires user interaction for exploitation. The attack vector is local (a crafted image must be processed), attack complexity is low, no privileges are required, and user interaction is needed.
Technical mechanism: ImageMagick includes HTTP and FTP coders that allow it to fetch remote resources as part of image processing. Certain image formats supported by ImageMagick (such as MVG and SVG) can contain references to external URLs. By crafting a malicious image with embedded URL references, an attacker can cause the ImageMagick process to initiate HTTP or FTP connections to arbitrary servers when the image is processed. This server-side request forgery allows the attacker to use the processing server as a proxy to reach internal network resources, cloud metadata services, or external attacker-controlled servers for data exfiltration.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a local attack vector requiring user interaction with no privileges required. The Integrity impact is HIGH because the attacker can forge requests from the server to internal and external resources. Confidentiality and Availability are rated None in the base score, though practical exploitation often yields confidential information through SSRF attacks on internal services.
Frequently Asked Questions
Is CVE-2016-3718 being actively exploited?
Yes, CVE-2016-3718 is part of the ImageTragick vulnerability set and has been actively exploited since its disclosure in May 2016. It is listed in CISA's KEV catalog. The EPSS score of 0.83834 (99.28th percentile) confirms very high exploitation likelihood.
What products are affected by CVE-2016-3718?
ImageMagick versions before 6.9.3-10 and 7.x versions before 7.0.1-1 are affected. This includes downstream distributions such as Red Hat Enterprise Linux 6 and 7, Ubuntu 12.04 through 16.04, Oracle Linux, Oracle Solaris, and any application that uses ImageMagick for image processing.
How do I fix CVE-2016-3718?
Update ImageMagick to version 6.9.3-10 or later (7.0.1-1+ for the 7.x branch). Disable HTTP, HTTPS, and FTP coders in the ImageMagick policy.xml file. Implement network egress filtering to restrict outbound connections from image processing servers and run ImageMagick in sandboxed environments.
How severe is CVE-2016-3718?
CVE-2016-3718 is rated MEDIUM with a CVSS 3.1 score of 5.5. The SSRF vulnerability allows attackers to make the server send requests to arbitrary destinations, potentially accessing internal services and cloud metadata. While the base severity is moderate, the practical risk is significant in cloud environments where metadata services contain sensitive credentials.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.