PT-2023-27208 · Unknown · Svg-Loader

R00Tdaemon · Published 2023-08-14 · Updated 2023-08-23 · CVE-2023-40013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions svg-loader versions prior to 1.6.9

Description The svg-loader library has insufficient input sanitization logic, allowing an attacker to craft a malicious SVG that can result in Cross-site Scripting (XSS). The library removes event attributes such as onmouseover and onclick but the list of events is not exhaustive, making it possible to bypass the sanitization. Any website that uses external-svg-loader and allows users to provide SVG sources or upload SVG files would be susceptible to a stored XSS attack.

Recommendations For versions prior to 1.6.9, upgrade to version 1.6.9 or later to address the issue. As a temporary workaround, consider disabling the use of external SVG files or restricting user uploads to minimize the risk of exploitation. Avoid using the onbegin attribute in the animate tag, as it can be used to execute JavaScript code without needing to add data-js="enabled".

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-40013

GHSA-XC2R-JF2X-GJR8

Affected Products

Svg-Loader

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40013.json · Exploit
• https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8 · Vendor Advisory
• https://github.com/shubhamjain/svg-loader/commit/d3562fc08497aec5f33eb82017fa1417b3319e2c · Patch
• https://osv.dev/vulnerability/CVE-2023-40013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40013 · Security Note
• https://osv.dev/vulnerability/GHSA-xc2r-jf2x-gjr8 · Vendor Advisory
• https://github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript · Note
• https://github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128 · Note
• https://github.com/shubhamjain/svg-loader · Note
• https://t.me/cvenotify/56461 · Telegram Post
• https://twitter.com/cracbot/status/1691328947429183488 · Twitter Post
• https://twitter.com/CVEnew/status/1691181807121698816 · Twitter Post
• https://t.me/cvenotify/57130 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691222565228797952 · Twitter Post