PT-2022-17494 · Unknown+2 · Convert-Svg-Core+2

Manh Nguyen Van · Published 2022-07-22 · Updated 2022-07-25 · CVE-2022-25759

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.2

Description The issue allows for Remote Code Injection via sending an SVG file containing the payload. This can be achieved by including malicious code within an onload attribute in the SVG file. When processed by convert-svg-core, which utilizes Puppeteer/Chromium, the malicious code can be executed.

Recommendations For versions prior to 0.6.2, update to version 0.6.2 or later to resolve the issue. As a temporary workaround, consider disabling the execution of code within onload attributes in SVG files until a patch is applied. Restrict access to the convert-svg-core package to minimize the risk of exploitation. Avoid using the onload attribute in SVG files until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-25759

GHSA-5GXC-FXCR-9326

Affected Products

Chromium

Puppeteer

Convert-Svg-Core

References · 9

• 🔥 https://github.com/neocotic/convert-svg/issues/81 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2849633 · Exploit
• https://github.com/neocotic/convert-svg/pull/82 · Patch
• https://github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e6efe7a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25759 · Security Note
• https://osv.dev/vulnerability/GHSA-5gxc-fxcr-9326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25759 · Vendor Advisory
• https://github.com/neocotic/convert-svg · Note
• https://t.me/cibsecurity/46839 · Telegram Post