CVE-2021-23631: convert-svg path traversal via crafted SVG file

CVE-2021-23631 · Severity: low · CVSS 3.1 · Published 2022-01-27

The convert-svg libraries are Node.js packages that transform SVG (Scalable Vector Graphics) files into PNG or JPEG images. An attacker can exploit a path traversal flaw by uploading a specially crafted SVG file that tricks the converter into reading arbitrary files from the server's file system and embedding their contents in the output image. This could expose sensitive files such as configuration files, private keys, or system credentials.

Technologies: convert-svg-core (npm). Vendors: npm.

Quick answers

Is CVE-2021-23631 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-23631 being exploited in the wild.
How severe is CVE-2021-23631?
Low severity, with a CVSS score of 3.1, published 27 January 2022.
Which products and versions are affected?
convert-svg-core (npm) SEMVER:introduced=0,last_affected=0.5.0; convert-svg-to-jpeg (npm) SEMVER:introduced=0,last_affected=0.5.0; convert-svg-to-png (npm) SEMVER:introduced=0,last_affected=0.5.0.
Is there a fix for CVE-2021-23631?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-23631 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-23631?
Check whether you run convert-svg-core (npm), convert-svg-to-jpeg (npm) or convert-svg-to-png (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a path traversal vulnerability (CWE-22) affecting convert-svg-core and its dependents convert-svg-to-png and convert-svg-to-jpeg in all versions up to 0.5.0. The vulnerability occurs because the SVG parser does not properly validate file references embedded in SVG elements (such as iframe src attributes pointing to file:// URLs). An unauthenticated attacker can craft an SVG file containing references to arbitrary file paths (e.g., file:///etc/passwd) and submit it for conversion; the conversion process will fetch and embed the file contents into the output PNG/JPEG image. The attack requires only the ability to supply an SVG file to the converter (network reachable, no authentication required). Patches are available in versions after 0.5.0.

Affected products

  • convert-svg-core (npm) SEMVER:introduced=0,last_affected=0.5.0
  • convert-svg-to-jpeg (npm) SEMVER:introduced=0,last_affected=0.5.0
  • convert-svg-to-png (npm) SEMVER:introduced=0,last_affected=0.5.0

Identifiers

  • CVE-2021-23631
  • GHSA-jv7g-9g6q-cxvw

Timeline

  • 2022-01-21: disclosed: CVE-2021-23631 published to NVD
  • 2022-01-27: advisory: GHSA-jv7g-9g6q-cxvw published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.