PT-2022-2570 · Unknown+2 · Image Processing+3

Janko · Published 2022-03-01 · Updated 2025-10-05 · CVE-2022-24720

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions image processing versions prior to 1.12.2 ruby-image-processing versions prior to 1.10.3-1+deb11u1

Description The image processing library, a wrapper for libvips and ImageMagick/GraphicsMagick, contains a flaw where unsanitized user input passed to the #apply method can lead to remote code execution. This occurs because the library does not adequately neutralize special elements used in operating system commands. The issue affects Active Storage variants as well, since they internally call this method. Exploitation of this flaw could allow a remote attacker to execute arbitrary shell commands.

API Endpoints: No specific API endpoints are mentioned. Vulnerable Parameters or Variables: operations Function Names: ImageProcessing::Vips.apply()

Recommendations Update image processing to version 1.12.2 or later. Update ruby-image-processing to version 1.10.3-1+deb11u1 or later. If you are processing images based on user input, always sanitize the input by allowing only a constrained set of operations.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2022-03011

CVE-2022-24720

DSA-5310-1

GHSA-CXF7-QRC5-9446

USN-6675-1

Affected Products

Active Storage

Linuxmint

Ubuntu

Image Processing

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24720.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/image_processing/CVE-2022-24720.yml · Exploit
• 🔥 https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446 · Exploit
• https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dada · Patch
• https://ubuntu.com/security/CVE-2022-24720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24720 · Security Note
• https://bdu.fstec.ru/vul/2022-03011 · Security Note
• https://osv.dev/vulnerability/DSA-5310-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxf7-qrc5-9446 · Vendor Advisory
• https://debian.org/security/2022/dsa-5310 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/676198 · Security Note
• https://ubuntu.com/security/notices/USN-6675-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24720 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24720 · Security Note
• https://osv.dev/vulnerability/USN-6675-1 · Vendor Advisory