Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Crafted SVG files submitted to Bing Images triggered critical OS command injection vulnerabilities, allowing arbitrary code execution as NT AUTHORITY\SYSTEM on Windows and root on Linux workers. The attack exploited ImageMagick’s delegate mechanism, where an SVG image reference containing a pipe character was interpreted as a shell command rather than a filename. Microsoft assigned two Critical severity CVEs (9.8 CVSS score) for the flaws: one via public upload and another via server-side URL fe
Analysis
TL;DR
- Crafted SVG files submitted to Bing Images triggered critical OS command injection vulnerabilities, allowing arbitrary code execution as NT AUTHORITY\SYSTEM on Windows and root on Linux workers.
- The attack exploited ImageMagick’s delegate mechanism, where an SVG image reference containing a pipe character was interpreted as a shell command rather than a filename.
- Microsoft assigned two Critical severity CVEs (9.8 CVSS score) for the flaws: one via public upload and another via server-side URL fetching (blind SSRF).
- XBOW successfully demonstrated out-of-band command execution without authentication or user interaction, though Microsoft patched the issue server-side before public disclosure.
- The incident highlights the persistent risk of treating image processing libraries as mere "plumbing" rather than part of the primary attack surface, echoing historical issues like ImageTragick.
Why It Matters
This vulnerability demonstrates how seemingly benign file formats like SVG can bypass application-level validation if underlying image processing libraries are misconfigured. For AI and software practitioners, it underscores the critical importance of securing third-party dependencies and configuring strict security policies for any component that processes untrusted input.
Technical Details
- Vulnerability Mechanism: The flaw relied on ImageMagick's delegate system. When parsing an SVG, the renderer followed an image reference starting with a pipe (
|), which invoked an external shell command instead of reading a file path. - Attack Vectors: Two distinct paths were identified:
- CVE-2026-32194: Direct upload of a base64-encoded SVG via the
/images/kblobendpoint. - CVE-2026-32191: Blind Server-Side Request Forgery (SSRF) where Bingbot fetched an attacker-controlled SVG URL via the
imgurlparameter.
- CVE-2026-32194: Direct upload of a base64-encoded SVG via the
- Privilege Escalation: The image processing workers executed commands with maximum privileges:
uid=0/gid=0on Linux andNT AUTHORITY\SYSTEMon Windows Server 2022 Datacenter. - Exploitation Method: XBOW used a one-pixel SVG payload to trigger the command injection and exfiltrate data via
curlto an external collector, proving the vulnerability through out-of-band channels due to the blind nature of the SSRF. - Remediation: Microsoft fixed the issue server-side. Recommended mitigations include disabling delegates in
policy.xml, restricting accepted formats (SVG, MVG, EPS), sandboxing workers, and blocking outbound network access from conversion services.
Industry Insight
- Security Configuration Audits: Organizations must audit the configuration of image processing libraries (like ImageMagick, GraphicsMagick) to ensure delegates are disabled by default for untrusted inputs, adhering to the principle of least privilege.
- Attack Surface Expansion: Developers should recognize that helper tools and parsers are part of the attack surface. Treating them as internal plumbing often leads to overlooked vulnerabilities that can result in full system compromise.
- Network Segmentation: Implementing strict egress filtering for servers handling untrusted media is essential to prevent out-of-band data exfiltration and limit the impact of potential command injection flaws.
Disclaimer: The above content is generated by AI and is for reference only.