A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
81FC97E7-D26F-47A4-A0D3-0E957026718D
7.1.1.11
OR
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
BB176AC3-3CDA-4DDA-9089-C67B2F73AA62
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
E30D0E6F-4AE8-4284-8716-991DFA48CC5D
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
CC559B26-5DFC-4B7A-A27C-B77DE755DFF9
OR
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
142AD0DD-4CF3-4D74-9442-459CE3347E3A
OR
### ImageMagick version

6.9.6-4

### Operating system

Linux

### Operating system, version and so on

Any

### Description

While reviewing historical vulnerabilities, I discovered an aribitary code execution vulnerability (shell command injection) in `OpenBlob`, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will `popen` the remaining part of the file name. As a fix, commit [ca430ff](https://github.com/ImageMagick/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7) add a configure option `--enable-pipes` to specially turn on the support of pipes; and in commit 40639d1, the invocation of `SanitizeString` is added before `popen_utf8` the filename to suppress aribitary command execution.

However, `SanitizeString` only filters out characters like single quotes but not `` ` `` or `"`. This allows shell command injection through malformed file name.

### Steps to Reproduce

#### Prerequisite

Configure ImageMagick with `./configure --enable-pipes`

#### Trigger

Given a normal image file, namely smile.gif, the following triggers the vulnerability:

```bash
/data/home/fullwaywang/exp
➜ echo deadbeef > test.txt

/data/home/fullwaywang/exp
➜ cp smile.gif '|smile"`cat test.txt > leak.txt`".gif'

/data/home/fullwaywang/exp
➜ magick identify '|smile"`cat test.txt > leak.txt`".gif'
sh: smile.gif: command not found
identify: ImproperImageHeader `/tmp/magick-UMqIH3bRZ6v-thgCZxEUhVyYUdKapEiV' @ error/gif.c/ReadGIFImage/1027.

/data/home/fullwaywang/exp
➜ cat leak.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
RCE (shell command injection) vulnerability in `OpenBlob` with `--enable-pipes` configured
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : RCE (shell command injection) vulnerability in `OpenBlob` with `--enable-pipes` configured
Issue date:

--- start body ---
### ImageMagick version

6.9.6-4

### Operating system

Linux

### Operating system, version and so on

Any

### Description

While reviewing historical vulnerabilities, I discovered an aribitary code execution vulnerability (shell command injection) in `OpenBlob`, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will `popen` the remaining part of the file name. As a fix, commit [ca430ff](https://github.com/ImageMagick/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7) add a configure option `--enable-pipes` to specially turn on the support of pipes; and in commit 40639d1, the invocation of `SanitizeString` is added before `popen_utf8` the filename to suppress aribitary command execution.

However, `SanitizeString` only filters out characters like single quotes but not `` ` `` or `"`. This allows shell command injection through malformed file name.

### Steps to Reproduce

#### Prerequisite

Configure ImageMagick with `./configure --enable-pipes`

#### Trigger

Given a normal image file, namely smile.gif, the following triggers the vulnerability:

```bash
/data/home/fullwaywang/exp
➜ echo deadbeef > test.txt

/data/home/fullwaywang/exp
➜ cp smile.gif '|smile"`cat test.txt > leak.txt`".gif'

/data/home/fullwaywang/exp
➜ magick identify '|smile"`cat test.txt > leak.txt`".gif'
sh: smile.gif: command not found
identify: ImproperImageHeader `/tmp/magick-UMqIH3bRZ6v-thgCZxEUhVyYUdKapEiV' @ error/gif.c/ReadGIFImage/1027.

/data/home/fullwaywang/exp
➜ cat leak.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
--- end body ---

comments :
--- start comments ---

--- end comments ---