Hacktron安全研究团队发现了HEIF Heist，一类影响HEIF、HEIC和AVIF图像解析器的远程攻击漏洞 1。该漏洞存在于libheif和libde265等原生C/C++库中，可导致内存损坏、数据泄露或远程代码执行 1。受影响的包括ImageMagick、libvips、Sharp等高级图像处理包装器，以及Discourse、Next.js等常见框架中的图像处理服务 1。
漏洞影响多个版本系列，包括1.19.x、1.20.x、1.22.x和1.23.x 1。研究团队建议用户升级至libheif v1.23.2或更高版本，并采用沙箱隔离等深度防御措施 1。利用该漏洞需要进行版本指纹识别和有针对性的payload定制，部分远程代码执行尝试需要上千次图像上传 1。使用AI模型可将漏洞利用开发时间从初始探测到实现远程代码执行缩短至1-3天 1。该研究由Harsh Jaiswal领导，团队成员包括Mohan SRK、Rahul Maini和Sudhanshu Rajbhar 1。
Security researchers at Hacktron have uncovered a class of remote code execution vulnerabilities affecting widely-used image processing libraries, collectively termed HEIF Heist 1. The vulnerability impacts native C/C++ parsers including libheif and libde265, which are commonly deployed through higher-level wrappers such as ImageMagick, libvips, and Sharp, as well as popular frameworks including Discourse and Next.js 1. The exploitable flaws can lead to memory corruption, data leakage, and remote code execution on affected systems 1.
The vulnerability affects multiple version branches of the vulnerable libraries, including versions 1.19.x, 1.20.x, 1.22.x, and 1.23.x 1. Hacktron recommends upgrading to libheif version 1.23.2 or later to mitigate the risk 1. Exploitation of the vulnerability requires version fingerprinting and customized payload development, with some remote code execution attempts necessitating thousands of image uploads 1. The research team noted that artificial intelligence models can accelerate exploit development, potentially reducing the timeline from initial detection to functional remote code execution to between one and three days 1. The investigation was led by Harsh Jaiswal, with contributions from team members Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar 1.
评论
还没有评论，欢迎留下第一条。