PARSER AUDIT LAB

Corrupted Image Vector Sanitizer & Security Parser

Target: OpenAI / Forum Software Ingestion Pipeline v4.2 Risk Score: 88 (CRITICAL)
Vector Frame & Header Byte Inspector
Corrupted Header Overlay 1.2 MB
[!] Malformed IHDR chunk offset: 0x0000000C
[!] Embedded script block inside EXIF chunk
Interactive canvas displays rendered raster blocks alongside segmented memory corruption zones.
Raw Chunk & Header Hex Stream (First 128 Bytes) Encoding: ISO-8859-1
Vulnerability Analysis & Ingestion Pipeline Audit Ready to Scan
3
Detected Anomalies
88/100
Pipeline Risk Index
0
Sanitized Chunks
Discourse / OpenAI Forum Pipeline Simulation Triggered Memory Overflow
Step: 2 of 4 (libheif heap overflow) CVE Context: Untracked Debian 1.19.7 Heap OOB R/W
Detected Header & Payload Vulnerabilities:
Real-time Ingestion Stream Log Vulnerabilities Present
[INIT] Loaded fixture: researcher_vector_sample_v2.png (1.2 MB)
[ALERT] Malformed IHDR chunk detected: width parameter exceeds integer bounds (0x7FFFFFFF)
[ALERT] Secondary malformed header: invalid CRC32 checksum in sRGB chunk
[ALERT] Non-pixel payload isolated: embedded <script> block inside EXIF profile
[WARN] Ingestion pipeline halted before forum avatar storage
Security Research Grounding & Incident Provenance:
Inspired by the September 2026 security disclosure documented by The Verge and Hacktron AI, wherein researchers discovered that corrupted HEIF/image files passed into Discourse forum software bypassed initial FastImage checks and triggered a heap buffer overflow in unpatched libheif (Debian package 1.19.7). In that disclosure, researchers chained this exploit with SSO session flaws to demonstrate access.
Remediation: Strip all ancillary chunks (tEXt, iTXt, zTXt, EXIF, XMP), re-encode raw pixel bitstreams through sandboxed isolated memory contexts, and enforce strict bounds-checking on IHDR dimensions prior to native delegate handoff.
Research Sources: The Verge on X · TechCrunch Coverage · Hacktron AI Technical Report
` concealed inside metadata string block, triggering secondary XSS/injection upon forum post rendering.', severity: 'critical' } ], hexBytes: [ { offset: '00000000', hex: '89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52', ascii: '.PNG........IHDR', highlight: '' }, { offset: '00000010', hex: '7F FF FF FF 00 00 02 80 08 06 00 00 00 E2 3B 89', ascii: '.........;..', highlight: 'corrupt', note: 'Malformed width bounds' }, { offset: '00000020', hex: '00 00 00 01 73 52 47 42 00 FF 11 A4 99 00 00 00', ascii: '....sRGB........', highlight: 'corrupt', note: 'Corrupt CRC' }, { offset: '00000030', hex: '3C 73 63 72 69 70 74 3E 65 76 61 6C 28 61 74 6F', ascii: '` concealed inside metadata string block, triggering secondary XSS/injection upon forum post rendering.', severity: 'critical' } ]; overlayText.hidden = false; overlayScript.hidden = false; overlayText.textContent = '[!] Malformed IHDR chunk offset: 0x0000000C'; overlayScript.textContent = '[!] Embedded script block inside EXIF chunk'; overlayText.style.background = 'rgba(239, 68, 68, 0.9)'; overlayScript.style.background = 'rgba(245, 158, 11, 0.95)'; threatIndicator.className = 'pill pill-danger'; threatIndicator.textContent = 'Risk Score: 88 (CRITICAL)'; fileSizeBadge.textContent = '1.2 MB'; canvasBadge.className = 'pill pill-danger'; canvasBadge.textContent = 'Corrupted Header Overlay'; pipelineStatusText.textContent = 'Triggered Memory Overflow'; pipelineStatusText.style.color = 'var(--danger)'; pipeSteps[0].className = 'p-step pass'; pipeSteps[1].className = 'p-step fail'; pipeSteps[2].className = 'p-step fail'; pipeSteps[3].className = 'p-step fail'; log('Loaded research vector reproduction: 2 header anomalies and 1 embedded text payload detected.', 'err'); } else if (presetKey === 'avatar') { btnPresetAvatar.classList.add('active'); STATE.filename = 'standard_forum_avatar.png'; STATE.fileSize = '142 KB'; STATE.riskScore = 0; STATE.anomalies = []; STATE.isSanitized = true; overlayText.hidden = true; overlayScript.hidden = true; threatIndicator.className = 'pill pill-success'; threatIndicator.textContent = 'Risk Score: 0 (BENIGN)'; fileSizeBadge.textContent = '142 KB'; canvasBadge.className = 'pill pill-success'; canvasBadge.textContent = 'Clean PNG Stream'; pipelineStatusText.textContent = 'Pipeline Passed Securely'; pipelineStatusText.style.color = 'var(--success)'; pipeSteps[0].className = 'p-step pass'; pipeSteps[1].className = 'p-step pass'; pipeSteps[2].className = 'p-step pass'; pipeSteps[3].className = 'p-step pass'; log('Loaded standard forum avatar: headers validated within canonical parameters.', 'ok'); } else if (presetKey === 'multivector') { btnPresetMulti.classList.add('active'); STATE.filename = 'polyglot_ai_probe_sample.png'; STATE.fileSize = '3.4 MB'; STATE.riskScore = 95; STATE.anomalies = [ { id: 'anom-m1', type: 'malformed_header', title: 'Polyglot PDF/PNG Ambiguous Magic Byte Prefix', chunk: 'Magic Bytes (0x89 0x50 0x4E 0x47 / %PDF-1.7)', desc: 'Dual header bytes configured to bypass forum filetype detection, redirecting execution path to document parsing engines.', severity: 'critical' }, { id: 'anom-m2', type: 'malformed_header', title: 'Recursive Decompression Chunk Bombs', chunk: 'zTXt Deflate Header', desc: 'Compression ratio of 1000:1 crafted to cause parser memory exhaustion on forum worker threads.', severity: 'critical' }, { id: 'anom-m3', type: 'embedded_script', title: 'SVG XML Entity Injection with Script Tags', chunk: 'XML Processing Instruction', desc: 'Inline payload containing <!ENTITY> declaration and script evaluation trigger.', severity: 'critical' } ]; overlayText.hidden = false; overlayScript.hidden = false; overlayText.textContent = '[!] Ambiguous Polyglot PDF/PNG Header'; overlayScript.textContent = '[!] Nested XML & zTXt Decompression Bomb'; overlayText.style.background = 'rgba(239, 68, 68, 0.9)'; overlayScript.style.background = 'rgba(220, 38, 38, 0.95)'; threatIndicator.className = 'pill pill-danger'; threatIndicator.textContent = 'Risk Score: 95 (CRITICAL)'; fileSizeBadge.textContent = '3.4 MB'; canvasBadge.className = 'pill pill-danger'; canvasBadge.textContent = 'Polyglot Attack Surface'; pipelineStatusText.textContent = 'Parser Panic / DoS Risk'; pipelineStatusText.style.color = 'var(--danger)'; pipeSteps[0].className = 'p-step fail'; pipeSteps[1].className = 'p-step fail'; pipeSteps[2].className = 'p-step fail'; pipeSteps[3].className = 'p-step fail'; log('Loaded polyglot multi-vector sample: severe recursive expansion hazard identified.', 'err'); } updateUI(); } function runParserScan() { scanStateLabel.textContent = 'Executing Scan...'; scanStateLabel.style.background = '#fef3c7'; scanStateLabel.style.color = '#92400e'; log(`Starting deep chunk audit on ${STATE.filename}...`, 'info'); setTimeout(() => { scanStateLabel.textContent = 'Audit Complete'; scanStateLabel.style.background = '#dbeafe'; scanStateLabel.style.color = '#1e40af'; if (STATE.isSanitized) { log('Audit complete: Zero structural parser anomalies found. Image is safe for ingestion.', 'ok'); statusSummary.textContent = 'Clean / Safe'; statusSummary.style.color = 'var(--success)'; } else { log(`Audit complete: Found ${STATE.anomalies.length} parser risk vectors including integer overflows and script injection tags.`, 'err'); statusSummary.textContent = 'Vulnerabilities Present'; statusSummary.style.color = 'var(--danger)'; } }, 350); } function sanitizeImage() { STATE.isSanitized = true; const strippedCount = STATE.anomalies.length; STATE.anomalies = []; STATE.riskScore = 0; // Update UI elements threatIndicator.className = 'pill pill-success'; threatIndicator.textContent = 'Risk Score: 0 (SANITIZED)'; canvasBadge.className = 'pill pill-success'; canvasBadge.textContent = 'Sanitized Clean Vector'; overlayText.hidden = true; overlayScript.hidden = true; pipelineStatusText.textContent = 'All Pipeline Checks Passed'; pipelineStatusText.style.color = 'var(--success)'; pipeSteps.forEach(step => { step.className = 'p-step pass'; }); statusSummary.textContent = 'Clean & Sanitized'; statusSummary.style.color = 'var(--success)'; log(`[SANITIZER] Stripped ${strippedCount} malformed chunks & script blocks.`, 'ok'); log('[SANITIZER] Normalizing IHDR chunk bounds to 460x280 standard dimensions.', 'ok'); log('[SANITIZER] Recalculating valid CRC32 across all remaining chunk headers.', 'ok'); log('[SANITIZER] Purged extraneous EXIF, XMP, and tEXt ancillary blocks.', 'ok'); updateUI(strippedCount); } function updateUI(sanitizedCountDelta = null) { metricAnomalies.textContent = STATE.anomalies.length; metricRisk.textContent = `${STATE.riskScore}/100`; if (STATE.isSanitized) { metricAnomalies.style.color = 'var(--success)'; metricRisk.style.color = 'var(--success)'; if (sanitizedCountDelta !== null) { metricSanitized.textContent = sanitizedCountDelta; metricSanitized.style.color = 'var(--success)'; } } else { metricAnomalies.style.color = 'var(--danger)'; metricRisk.style.color = 'var(--danger)'; metricSanitized.textContent = '0'; metricSanitized.style.color = 'var(--muted)'; } renderCanvasPreview(); renderHexViewer(); renderAnomalyList(); } // Export Clean Download function exportCleanFile() { if (!STATE.isSanitized) { sanitizeImage(); } // Generate a clean PNG Blob from canvas canvasEl.toBlob((blob) => { const cleanName = STATE.filename.replace('.png', '_sanitized_clean.png'); const fileBlob = blob || new Blob(['\\x89PNG\\r\\n\\x1a\\n...SANITIZED_CLEAN_PAYLOAD...'], { type: 'image/png' }); // QA handoff channel globalThis.__codexQaLastDownload = { filename: cleanName, blob: fileBlob, size: fileBlob.size }; const url = URL.createObjectURL(fileBlob); const a = document.createElement('a'); a.href = url; a.download = cleanName; document.body.appendChild(a); a.click(); document.body.removeChild(a); setTimeout(() => URL.revokeObjectURL(url), 2000); log(`Exported sanitized file: ${cleanName} (${fileBlob.size} bytes).`, 'ok'); }, 'image/png'); } // Export Security Report function exportSecurityReport() { const report = { tool: "Corrupted Image Vector Sanitizer & Security Parser", auditTimestamp: new Date().toISOString(), slug: "ai-image-exploit-sandbox-90", targetParser: STATE.targetParser, inputFixture: { filename: STATE.filename, originalSize: STATE.fileSize, initialRiskScore: STATE.isSanitized ? 0 : STATE.riskScore }, auditFindings: { totalAnomaliesDetected: STATE.isSanitized ? 0 : STATE.anomalies.length, anomalies: STATE.anomalies, sanitizationStatus: STATE.isSanitized ? "VERIFIED_CLEAN" : "VULNERABILITIES_PRESENT", remediationApplied: STATE.isSanitized ? [ "Purged non-pixel metadata chunks (EXIF, tEXt, zTXt)", "Normalized IHDR dimensions within integer safety boundaries", "Recalculated CRC32 checksums for image stream consistency", "Isolated rendering into sandboxed memory context" ] : [ "Pending sanitization action" ] }, cveContext: "Simulated mitigation for unpatched libheif/ImageMagick buffer overflows (Debian 1.19.7 incident documented by The Verge & Hacktron AI)." }; const reportString = JSON.stringify(report, null, 2); const reportBlob = new Blob([reportString], { type: 'application/json' }); const reportName = `security_audit_report_${STATE.filename.replace('.png', '')}.json`; globalThis.__codexQaLastDownload = { filename: reportName, blob: reportBlob, size: reportBlob.size }; const url = URL.createObjectURL(reportBlob); const a = document.createElement('a'); a.href = url; a.download = reportName; document.body.appendChild(a); a.click(); document.body.removeChild(a); setTimeout(() => URL.revokeObjectURL(url), 2000); log(`Exported diagnostic report: ${reportName}`, 'ok'); } // Event Bindings btnPresetResearch.addEventListener('click', () => loadPreset('research')); btnPresetAvatar.addEventListener('click', () => loadPreset('avatar')); btnPresetMulti.addEventListener('click', () => loadPreset('multivector')); btnRunScan.addEventListener('click', runParserScan); btnSanitizeNow.addEventListener('click', sanitizeImage); btnExportClean.addEventListener('click', exportCleanFile); btnExportReport.addEventListener('click', exportSecurityReport); // Initial load window.addEventListener('DOMContentLoaded', () => { loadPreset('research'); });
Enjoy this tool? Build your own with Super