ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data.
This issue is fixed in version 4.1.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 5
https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31…
security-advisories@github.com
https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a95…
security-advisories@github.com
https://github.com/SixLabors/ImageSharp/pull/3187
security-advisories@github.com
https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
security-advisories@github.com
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p
security-advisories@github.com