Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Microsoft (Bing)
Incident: Remote code execution via crafted SVG files in Bing’s image processing pipeline.
Impact: Full system compromise of production image-processing workers across different hosts.
Attacker: XBOW (Security Researchers)
Analysis: The vulnerability stemmed from the way Bing’s backend handled SVG images through a delegate-based conversion suite. By injecting a pipe character into image references, researchers triggered shell execution on production workers. This allowed unauthenticated remote code execution as NT AUTHORITY\SYSTEM on Windows and root on Linux.
Recommendations: Disable unnecessary ImageMagick delegates to prevent shell execution.; Strictly validate and sanitize image file formats and internal references.; Isolate image processing workers in hardened, network-restricted environments.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source