WordPress: Remote Code Execution via HEIF Image Processing

The Fortbridge research team published an analysis of an exploitation chain that enables code execution on a WordPress server through a vulnerability in the libheif, a library designed to process HEIF images. The flaw is a heap buffer overflow that occurs when decoding images using the unci codec. With a specific combination of image parameters, the library writes data beyond the allocated memory region, allowing adjacent objects in the process memory to be corrupted.

To exploit the flaw, an attacker with file upload privileges prepares a specially crafted HEIF image and uploads it to the WordPress media library. The server-side image processing chain, which includes PHP Imagick, ImageMagick, and libheif, decodes the file and executes the vulnerable code path. A controlled out-of-bounds write makes it possible to manipulate a C++ virtual function table pointer and redirect execution. The researcher also used an additional memory disclosure vulnerability to recover the addresses needed to bypass ASLR. The chain was confirmed to work on a specific WordPress 7.1 configuration running Debian, but universal exploitation across all installations has not been demonstrated.

Successful exploitation may allow an attacker to read files accessible to the image-processing process and execute commands with its privileges. In the tested configuration, the researcher was able to read /etc/passwd and execute PHP code on the server. This created a risk of further site compromise, theft of accessible credentials, and modification of the website's content. Exploitation requires an accessible image upload path, and the outcome depends on the library version, server configuration, and how objects are laid out in memory.

Article: https://fortbridge.co.uk/research/wordpress-libheif-rce/