Security researchers have unveiled a potential threat involving HEIC images that can lead to remote code execution on WordPress servers. By exploiting an attack chain, an ordinary image upload can be manipulated to execute code within the PHP-FPM process that powers the site.
The Vulnerability in Image Processing
The root of this vulnerability lies in libheif, a component used to decode HEIC, HEIF, and AVIF files. When a WordPress server processes an image using ImageMagick, a specifically crafted file can take advantage of libheif’s weaknesses to corrupt memory, instead of generating a proper image.
Fortbridge researchers have identified a systematic approach that utilizes this flaw, combined with memory data leaked from WordPress-generated JPEGs, to execute malicious code. This discovery highlights the necessity of scrutinizing image uploads as much as other server-side inputs, especially when high-risk photo formats from modern devices are involved.
Exploitation Criteria and Impact
The attack scenario requires a logged-in WordPress user with permission to upload files, typically an Author or higher. While the findings are largely theoretical and have not yet been observed in active campaigns, they were successfully demonstrated on specific Linux software configurations.
The vulnerability, tracked as GHSA-x8r2-mggj-j6wr, affects the uncompressed image decoder in libheif. An attacker can craft a file to exploit a memory allocation error, causing overflow and potentially redirecting essential program operations.
Mitigation Strategies and Recommendations
To mitigate this risk, administrators are urged to update libheif to version 1.23.3 or later, addressing the vulnerability identified from versions 1.18.0 to 1.23.2. Additional precautionary measures include blocking HEIC and AVIF uploads, removing unnecessary codecs, and processing media in isolated environments.
Operators are advised to investigate any unusual PHP-FPM worker exits or HTTP 503 responses after HEIC uploads. Limiting writable paths and disabling script execution in upload directories can also help minimize damage in case of an exploit.
Although no active exploitation campaigns have been reported, the importance of proactive measures cannot be overstated. Regular updates and vigilance in monitoring server behavior are crucial in safeguarding against potential threats.
