Summary Points
- Attackers exploited Bing’s image search by embedding malicious SVG files that run commands on its image-processing infrastructure, leading to remote code execution as SYSTEM or root.
- The vulnerability stemmed from SVG references with pipe characters that execute commands via ImageMagick’s delegate layer, enabling command injection without user authentication.
- Microsoft fixed the vulnerabilities server-side but emphasizes that improper configuration—such as allowing delegate execution, trusted formats, and outbound network access—remains a critical attack surface.
Threat, Attack Techniques, and Targets
The security flaw involved crafted SVG images submitted to Bing’s image search. These SVGs could run commands as NT AUTHORITY\SYSTEM on Microsoft’s servers and as root on Linux machines in the same infrastructure. The attack was tested by XBOW, an offensive cybersecurity startup, and showed that the problem was in Bing’s image processing layer, not on individual machines.
The attack relied on SVG images referencing external content. Since SVG is an XML format, it can include references to other images or commands. A downloader following those references could invoke shell commands through a delegate-enabled path, particularly if the rendering software passed the image to a shell. Attackers used SVGs with references that started with a pipe character (|), which directed the server to run commands.
There were two main routes for these exploits. First, the “Search by Image” feature allowed users to upload SVG images, which could contain malicious references. Second, the crawler route used the imgurl parameter to fetch remote SVGs, with no authentication required. Both methods required only that the SVG references be crafted to run commands.
Impact, Security Implications, and Remediation Guidance
The flaw allowed attackers to execute commands with high privileges directly on Microsoft’s servers. On Linux, commands run with uid=0, the root user. On Windows, commands had access to system privileges, with Privileges like SeImpersonatePrivilege and SeDebugPrivilege enabled. Since commands executed through the SVG references could fetch and run malicious code, this created serious security risks.
Microsoft addressed this problem by fixing both CVEs server-side before public advisories. No patch or mitigation was provided to customers, and Microsoft stated there was “no customer action to resolve.” The vulnerability could lead to remote code execution, data access, or server control if exploited.
To mitigate such risks, organizations should disable delegate-enabled paths and restrict the formats accepted in image processing systems. Blocking SVG and similar formats with external references is crucial. Additionally, disabling outbound network connections from image-processing workers and running such services with reduced privileges can help prevent exploitation. For more detailed remediation steps, organizations should consult the official guidance from Microsoft and the vendor responsible for their image-processing tools.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
