ImageMagick Upload Handling Exposes Web Apps to DoS and Information Leakage

Web applications that process user-uploaded images with ImageMagick can expose a broad attack surface when upload controls rely on file extensions or weak type checks. Research describing Rails applications using CarrierWave and MiniMagick showed that attackers may influence both the input and output formats passed to ImageMagick, enabling abuse of vulnerable coders and delegates beyond expected image types. The reports warned that ImageMagick has a long history of flaws including denial of service, memory corruption, and possible code execution, and demonstrated that output formats such as INFO and EPS3 can leak absolute server paths and ImageMagick version details into generated files.

The findings align with OWASP guidance on unrestricted file upload, which says unsafe upload handling can lead to code execution, information disclosure, client-side attacks, malware hosting, and service disruption. One proof of concept showed that a crafted JPEG of only about 5 KB, with manipulated dimensions of 64250 x 64250, could drive ImageMagick to allocate roughly 33 GB of pixel cache and destabilize a host. Recommended defenses included strict allow-listing of formats such as JPEG, GIF, and PNG; validating magic bytes against extensions before processing; enforcing policy.xml resource limits and execution timeouts; restricting upload size; using non-executable and isolated storage; sandboxing image processing; limiting concurrency; and keeping ImageMagick updated.