Inside Burp Image Size: Detecting Resource Exhaustion and ImageMagick RCE Through Passive Traffic Analysis

Hook

A single URL parameter controlling image dimensions can crash your application server—and most security scanners never notice because they're not correlating HTTP parameters with response characteristics.

Context

Image processing is one of those features that every web application needs but few developers secure properly. When users can upload profile pictures or request dynamically resized thumbnails, you're running ImageMagick or similar libraries on untrusted input. In 2016, the ImageTragick vulnerability (CVE-2016-3714) exposed how ImageMagick's file format parsers could execute arbitrary shell commands, turning every image upload endpoint into a potential RCE vector. But there's an even more subtle issue: applications that let URL parameters control image dimensions (width=5000&height=5000) create a trivial denial-of-service attack surface. Processing a 5000x5000 pixel image consumes exponentially more memory and CPU than a 500x500 thumbnail.

The silentsignal/burp-image-size extension addresses both problems within the Burp Suite ecosystem. Rather than forcing penetration testers to manually identify size parameters and craft ImageTragick payloads, this plugin passively monitors all HTTP traffic flowing through Burp's proxy, building a correlation model between URL parameters and image response sizes. When it detects that changing a 'width' parameter from 100 to 200 doubles the response size, it flags a potential DoS vector. For ImageTragick, it switches to active scanning mode, injecting specially crafted MVG and SVG payloads that trigger time delays or out-of-band DNS callbacks through Burp Collaborator. This dual passive-active approach catches vulnerabilities that traditional scanners miss because they don't understand the semantic relationship between parameters and image processing behavior.

Technical Insight

The plugin's architecture leverages Burp's Extender API through two distinct scanner components: a passive scanner for size correlation and an active scanner for ImageTragick exploitation. The passive scanner implements IHttpListener to intercept every request-response pair. When it detects an image content type (checking for MIME types like image/jpeg, image/png), it extracts all URL parameters and compares them against the Content-Length header. The clever part is the correlation algorithm—it looks for numeric parameters where the parameter value has a roughly linear or quadratic relationship with response size.

Here's the conceptual detection logic that the plugin employs:

// Simplified correlation detection pseudocode
public void analyzeResponse(IHttpRequestResponse messageInfo) {
    IResponseInfo response = helpers.analyzeResponse(messageInfo.getResponse());
    IRequestInfo request = helpers.analyzeRequest(messageInfo.getRequest());
    
    if (isImageResponse(response)) {
        List<IParameter> params = request.getParameters();
        int contentLength = getContentLength(response);
        
        for (IParameter param : params) {
            if (isNumeric(param.getValue())) {
                // Track this parameter across multiple requests
                String key = getBaseUrl(request) + ":" + param.getName();
                correlationMap.computeIfAbsent(key, k -> new ArrayList<>());
                correlationMap.get(key).add(new DataPoint(
                    Integer.parseInt(param.getValue()),
                    contentLength
                ));
                
                // If we have enough data points, check correlation
                if (correlationMap.get(key).size() >= 3) {
                    double correlation = calculateCorrelation(
                        correlationMap.get(key)
                    );
                    
                    if (correlation > 0.7) {  // Strong positive correlation
                        reportIssue(messageInfo, param.getName(), 
                            "Image size controlled by URL parameter",
                            "High");
                    }
                }
            }
        }
    }
}

This passive approach accumulates evidence over time rather than making a single-shot determination. If you're browsing an image gallery that uses ?size=small, ?size=medium, and ?size=large, the plugin won't have enough numeric data to correlate. But if the application uses ?width=200 and you later request ?width=400, it starts building a statistical model. The threshold-based detection (correlation > 0.7) avoids false positives from coincidental size variations.

For active ImageTragick testing, the plugin takes a more aggressive stance. It constructs malicious image files with embedded ImageMagick commands. The key insight is that ImageMagick processes various file formats by delegating to external programs, and the MVG (Magick Vector Graphics) format parser was particularly vulnerable to command injection. The plugin generates payloads like:

push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|sleep 10|"'
pop graphic-context

When ImageMagick parses this MVG file, it interprets the pipe characters as shell command separators, executing sleep 10 before continuing. The plugin measures response time—if the server takes 10+ seconds to respond, it's likely vulnerable. But timing attacks are unreliable over the network, so the plugin also uses Burp Collaborator for out-of-band detection. It generates a unique Collaborator subdomain and embeds it in payloads:

push graphic-context
fill 'url(https://BURP-COLLABORATOR-SUBDOMAIN/x.jpg'
pop graphic-context

If the plugin later receives a DNS lookup or HTTP request to that Collaborator subdomain, it confirms the vulnerability without relying on timing. This is particularly powerful for blind command injection scenarios where you can't see command output but can trigger network callbacks.

The plugin integrates these findings into Burp's issue tracking system using the IScanIssue interface. Each detected vulnerability appears in Burp's Target tab with severity ratings, detailed descriptions, and remediation advice. For the size parameter issues, it suggests implementing maximum dimension limits and rate limiting. For ImageTragick, it recommends updating ImageMagick, using policy files to disable vulnerable coders, or switching to safer image processing libraries.

One architectural decision worth noting: the plugin uses Ant for builds rather than Maven or Gradle. While this feels dated, it actually simplifies deployment—you get a single JAR file with no dependency management complexity. The Burp Extender API is the only external dependency, and Burp provides that at runtime. This means the plugin loads instantly without fetching transitive dependencies or dealing with version conflicts.

Gotcha

The most significant limitation is the plugin's age and narrow scope. It was built to detect CVE-2016-3714 specifically, meaning newer ImageMagick vulnerabilities (like CVE-2022-44268, an information disclosure issue) won't be caught. The ImageTragick vulnerability itself is mostly a legacy concern—any organization running patched systems shouldn't be affected, making this primarily useful for testing older or poorly maintained applications. If you're assessing modern web applications, you'll likely find the plugin produces zero ImageTragick findings.

The passive detection for size-based DoS is more universally applicable, but it has false positive potential. Applications that implement intelligent caching or CDN integration might serve different file sizes for the same parameters based on whether a cached version exists. The plugin sees ?width=500 return 45KB on first request (cache miss, generates large PNG) and 12KB on second request (cache hit, serves optimized WebP), triggering alerts about inconsistent behavior. You'll spend time investigating findings that turn out to be caching artifacts rather than security issues. Additionally, the correlation algorithm requires multiple requests to the same endpoint with different parameter values—if you're testing an API endpoint that only accepts a fixed set of dimensions, the plugin never accumulates enough data points to calculate meaningful correlations. The Professional Edition requirement for active scanning and Collaborator features also limits accessibility for smaller teams or independent researchers working with the free Community Edition.

Verdict

Use if: You're conducting penetration tests with Burp Suite Professional against applications that dynamically resize images based on URL parameters, especially legacy systems that might still be running vulnerable ImageMagick versions. The passive detection for resource exhaustion DoS vectors is genuinely useful and catches issues that manual testing often misses. It's also worth using if you're building a comprehensive Burp extension suite and want coverage for image processing edge cases without deploying separate tooling. Skip if: You're testing modern applications where ImageMagick has been patched for years, you don't have Burp Professional (the free version severely limits functionality), or you need a CI/CD-integrated solution rather than interactive proxy-based testing. For automated vulnerability scanning in build pipelines, Nuclei templates or custom ImageMagick CLI scripts provide better integration. Also skip if you're looking for actively maintained tooling—this project hasn't seen updates since 2017 and won't detect newer image processing vulnerabilities.