Skip to content

Commit 88bb2e2

Browse files
committed
Update description
1 parent 9e97feb commit 88bb2e2

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

modules/exploits/unix/fileformat/imagemagick_delegate.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ def initialize(info = {})
2121
a .png (for example) which is actually a crafted SVG (for example) that
2222
triggers the command injection.
2323
24-
Tested on Linux, BSD, and OS X. You'll want to choose your payload
25-
carefully due to portability concerns. Use cmd/unix/generic if need be.
24+
The PostScript (PS) target leverages a Ghostscript -dSAFER bypass
25+
(discovered by taviso) to achieve RCE in the Ghostscript delegate.
26+
Ghostscript versions 9.18 and later are affected.
2627
2728
If ImageMagick supports popen(), a |-prefixed command will be used for
2829
the exploit. No delegates are involved in this exploitation.

0 commit comments

Comments
 (0)