main.go

// cve-2022-44268-detector is a Go program that consumes PNGs and reports
// whether they appear to be malicious images generated by an exploit for
// CVE-2022-44268, an ImageMagick vulnerability that allows attackers to
// read arbitrary file contents using specially crafted images.
package main

import (
	"errors"
	"flag"
	"io"
	"log"
	"os"
	"regexp"

	"github.com/jnschaeffer/cve-2022-44268-detector/internal/image/png"
	"github.com/jnschaeffer/cve-2022-44268-detector/internal/imutil"
)

const (
	// profileKeyword is the string that imagetragic appears to use for
	// the png chunk keyword containing leaked data. The code path is
	// not immediately obvious in the codebase, but dynamic analysis
	// appears to indicate it uses this string.
	//
	//	$ git status
	//	HEAD detached at 7.0.9-17
	//	nothing to commit, working tree clean
	//	$ git grep 'Raw profile type'
	//	coders/png.c:    We have already read "Raw profile type.
	//	coders/png.c:            memcmp(text[i].key, "Raw profile type ",17) == 0)
	//	coders/png.c:      "Raw profile type ",MagickPathExtent);
	profileKeyword = "Raw profile type"
)

var (
	filename      string
	printContents string
	keywordRegexS string
	debug         bool

	errNoIOCFound = errors.New("no potential indicators of compromise found")
)

func init() {
	flag.StringVar(&filename, "filename", "", "filename to parse (uses stdin if not set)")
	flag.StringVar(&printContents, "print", "",
		"if set, write each suspicious png chunk's value to stdout.\n"+
			"May specify: '"+imutil.WRaw+"', '"+imutil.WDecompress+"', '"+imutil.WDecompressHexdecode+"'")
	flag.StringVar(&keywordRegexS, "keyword", "^"+profileKeyword+"$", "regex to match png chunk keyword")
	flag.BoolVar(&debug, "debug", false, "enable debug logging if set. The program will emit information about\n"+
		"unknown png chunk types")
}

func main() {
	flag.Parse()

	log.SetFlags(0)

	if debug {
		png.Debug = log.New(log.Writer(), "[debug] ", log.Flags()|log.Lmsgprefix)
	}

	switch printContents {
	case "", imutil.WRaw, imutil.WDecompress, imutil.WDecompressHexdecode:
		// Permitted output values.
	default:
		log.Fatalf("unknown output mode: '%s'", printContents)
	}

	keywordRegex, err := regexp.Compile(keywordRegexS)
	if err != nil {
		log.Fatalf("failed to parse png chunk keyword regex - %s", err)
	}

	var r io.Reader = os.Stdin
	if filename != "" {
		f, err := os.Open(filename)
		if err != nil {
			log.Fatal(err)
		}

		defer f.Close()

		r = f
	}

	chunks, err := png.FindTextChunks(r)
	if err != nil {
		log.Fatal(err)
	}

	err = findChunks(keywordRegex, chunks)
	if err != nil {
		log.Println(err)

		if errors.Is(err, errNoIOCFound) {
			os.Exit(10)
		}

		os.Exit(1)
	}
}

func findChunks(keywordRegex *regexp.Regexp, chunks []png.TextChunk) error {
	numFound := 0

	for _, chunk := range chunks {
		if keywordRegex.MatchString(chunk.Keyword) {
			log.Printf("***POTENTIAL INDICATOR OF COMPROMISE*** - "+
				"keyword: '%s' | compressed: %t | id: %d | offset: 0x%x | len: %d",
				chunk.Keyword, chunk.Compressed, numFound, chunk.Offset, len(chunk.Value))

			if printContents != "" {
				err := imutil.WriteChunkTo(&chunk, os.Stdout, printContents)
				if err != nil {
					return err
				}
			}

			numFound++
		}
	}

	if numFound == 0 {
		return errNoIOCFound
	}

	return nil
}