CVE-2024-48514
📋 TL;DR
CVE-2024-48514 is a critical code injection vulnerability in php-heic-to-jpg library versions 1.0.5 and below. Attackers can execute arbitrary code on the server by uploading HEIC images with malicious filenames. This affects any PHP application using vulnerable versions of this library for HEIC image conversion.
💻 Affected Systems
- php-heic-to-jpg
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to execute commands, access sensitive data, and potentially pivot to other systems.
If Mitigated
Limited impact with proper input validation and file upload restrictions in place.
🎯 Exploit Status
Exploitation requires ability to upload HEIC files to the vulnerable application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.6
Vendor Advisory: https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-48514/
Restart Required: No
Instructions:
1. Update composer.json to require "maestroerror/php-heic-to-jpg": "^1.0.6"
2. Run composer update maestroerror/php-heic-to-jpg
3. Test HEIC conversion functionality
🔧 Temporary Workarounds
Disable HEIC uploads
allBlock HEIC file uploads at the application or web server level
Filename sanitization
allImplement strict filename validation and sanitization before processing
🧯 If You Can't Patch
- Implement strict file upload restrictions allowing only trusted file types
- Deploy WAF rules to detect and block malicious filename patterns
🔍 How to Verify
Check if Vulnerable:
Check composer.lock or installed packages for php-heic-to-jpg version <= 1.0.5Check Version:
composer show maestroerror/php-heic-to-jpg | grep versionsVerify Fix Applied:
Verify installed version is 1.0.6 or higher using composer show maestroerror/php-heic-to-jpg📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with suspicious filenames
- HEIC file upload attempts with special characters in filenames
- Unexpected process execution from PHP context
Network Indicators:
- POST requests with HEIC files to upload endpoints
- Outbound connections from web server to unexpected destinations
SIEM Query:
source="web_logs" AND (file_extension="heic" OR file_extension="HEIC") AND filename MATCHES "[;|&`$()]"