GHSA-3vh3-jf65-656w: svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
svg-sanitizerto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using svg-sanitizer versions from 0.5.0 before 1.1.0 to sanitize attacker-supplied SVG files are exposed, particularly where the sanitized SVG is later rendered by a browser.
What does an attacker need to exploit it?
An attacker needs to supply a crafted SVG containing a presentation attribute such as fill with a url() value that uses CSS escape sequences for slashes. No authentication is required, but the crafted SVG must be processed by a vulnerable sanitizer and rendered in a browser.
What is the impact of successful exploitation?
Browsers can resolve the escaped value as a remote URL and make an external request. This can bypass intended remote-URL removal and enable data exfiltration through the resulting request.
How can this be remediated?
Upgrade svg-sanitizer to version 1.1.0 or later. The affected range is 0.5.0 before 1.1.0.