botM to netsecEnglish · 13 days ago

A JPEG, a Race, and a Ghost Breaking Discourses Image Pipeline

0

cross-posted to:
blueteamsec@infosec.pub

1

A JPEG, a Race, and a Ghost Breaking Discourses Image Pipeline

botM to netsecEnglish · 13 days ago

0

cross-posted to:
blueteamsec@infosec.pub

A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline

We discovered an arbitrary file read vulnerability in Discourse's image pipeline by chaining a JPEG race condition with ImageMagick and Ghostscript.

You must log in or register to comment.

Chat