PT-2023-21712 · Unknown · Svg-Sanitizer

Published 2023-03-20 · Updated 2023-03-23 · CVE-2023-28426

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions savg-sanitizer versions prior to 0.16.0

Description A bypass has been found in the savg-sanitizer library that allows an attacker to upload an SVG with persistent cross-site scripting. The issue arises from incorrect sanitization of HTML elements within CDATA nodes, which were being converted to text nodes and not recognized as DOM elements. To address this, any data within a CDATA node will now be sanitized using HTMLPurifier. Additionally, many HTML and MathML elements have been removed from the allowed element list, as they are not valid within the SVG context without ForeignObject.

Recommendations For versions prior to 0.16.0, update to version 0.16.0 or higher to fix the issue. As a temporary workaround, consider disabling the use of CDATA nodes in SVG uploads until the update can be applied. Restrict access to the svg-sanitizer library to minimize the risk of exploitation. Avoid using the library for sanitizing SVG files that may contain malicious HTML elements within CDATA nodes until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28426

GHSA-XRQQ-WQH4-5HG2

Affected Products

Svg-Sanitizer

References · 10

• https://osv.dev/vulnerability/GHSA-xrqq-wqh4-5hg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28426 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28426 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28426 · Security Note
• https://ubuntu.com/security/CVE-2023-28426 · Vendor Advisory
• https://github.com/darylldoyle/svg-sanitizer · Note
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-xrqq-wqh4-5hg2 · Note
• https://github.com/darylldoyle/svg-sanitizer/commit/cce18bc237c05c6e093e9672db7926788da9b322 · Note
• https://github.com/darylldoyle/svg-sanitizer/issues/88 · Note
• https://t.me/cibsecurity/60323 · Telegram Post