Image Size Issues
Summary: A Burp Suite extension by Andras Veres-Szentkiralyi passively detects potential denial of service attacks caused by image sizes specified in request parameters, since scaling features that accept a size from a URL can be used to make images huge rather than small. In active scanning mode the extension also detects ImageTragick (CVE-2016-3714) in an experimental manner based on timing.
What's compelling: A single request parameter that controls image dimensions can be turned into a denial of service against your own service, and the extension's ImageTragick detection is only experimental and timing-based, so it is not a guarantee.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2016-3714
- Related
- CVE-2016-3714: Image Magick Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Sep 09, 2024Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026