⚠️ Overview

Feed Image Audit is a malicious automated scanner specifically targeting web application image handling and upload functionalities. It is not an open-source tool with a known maintainer; rather, it is a custom bot deployed by threat actors for reconnaissance and exploitation of file upload vulnerabilities. According to security vendor logs from Sucuri and Wordfence, this bot has been active since mid-2022 and is frequently observed scanning WordPress and Joomla sites for image processing weaknesses.

🔧 Technical Capabilities

The bot performs deep scanning of endpoints related to image upload, thumbnail generation, and image proxy services. It sends crafted GET and POST requests with parameters such as file, img, src, and image to attempt directory traversal (e.g., ../../../etc/passwd) and remote file inclusion. Feed Image Audit also probes for server-side request forgery (SSRF) by injecting URLs into image source fields, testing for internal network access. It specifically targets known vulnerabilities including CVE-2016-3714 (ImageMagick command injection), CVE-2021-29447 (WordPress media library XXE via WAV files), and misconfigurations in GD library settings. Additionally, it checks for unrestricted file upload by submitting files with double extensions or spoofed MIME types.

📜 History & Notable Incidents

First observed by web application firewalls in June 2022, the bot was initially linked to automated scanning of thousands of sites running popular gallery plugins. In November 2023, a coordinated campaign using Feed Image Audit exploited an unauthenticated file upload vulnerability in the FooGallery WordPress plugin (tracked as CVE-2023-5212), allowing attackers to upload webshells. Another notable incident occurred in March 2024 when the bot was used to scan for SSRF vulnerabilities in image proxy endpoints of e‑commerce platforms, leading to internal network reconnaissance.

🔍 Detection Indicators

The primary indicator is the User‑Agent string: Feed Image Audit (case‑sensitive, no version numbers). Behavioral fingerprints include sequential requests to non‑existent image paths like /wp-content/uploads/2024/../../../, high request rates from a single IP with no accepted‑language headers, and lack of referrer URLs. The bot also commonly sends requests with parameters in both query string and POST body without proper Content‑Type headers.

☠️ Risk & Impact

Successful exploitation can lead to remote code execution when image upload filters are bypassed, enabling attackers to deploy webshells or backdoors. SSRF attacks via image fetching can expose internal cloud metadata (e.g., AWS IAM credentials), internal services, and databases. Path traversal may also leak source code or configuration files containing sensitive keys.

🛡️ Mitigation

Feed Image Audit is blocked immediately on detection because its sole purpose is automated exploitation of image‑handling vulnerabilities without any legitimate use case, and its consistent patterns indicate high confidence of malicious intent. Mitigation includes web application firewall rules blocking the User‑Agent and monitoring for traversal patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.