### [CVE-2024-41817](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41817)
![](https://img.shields.io/static/v1?label=Product&message=ImageMagick&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%207.11-36%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-427%3A%20Uncontrolled%20Search%20Path%20Element&color=brighgreen)

### Description

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

### POC

#### Reference
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8

#### Github
- https://github.com/Dxsk/CVE-2024-41817-poc
- https://github.com/OneGoshko12/htb-titanic
- https://github.com/maikneysm/AutoPwn-Titanic.htb
- https://github.com/mxdelta/CVE
- https://github.com/plzheheplztrying/cve_monitor
- https://github.com/sorshi/comistream-reader
- https://github.com/zhanpengliu-tencent/medium-cve