Executive brief
The convert-svg libraries are Node.js packages that transform SVG (Scalable Vector Graphics) files into PNG or JPEG images. An attacker can exploit a path traversal flaw by uploading a specially crafted SVG file that tricks the converter into reading arbitrary files from the server's file system and embedding their contents in the output image. This could expose sensitive files such as configuration files, private keys, or system credentials.
Technical details
This is a path traversal vulnerability (CWE-22) affecting convert-svg-core and its dependents convert-svg-to-png and convert-svg-to-jpeg in all versions up to 0.5.0. The vulnerability occurs because the SVG parser does not properly validate file references embedded in SVG elements (such as iframe src attributes pointing to file:// URLs). An unauthenticated attacker can craft an SVG file containing references to arbitrary file paths (e.g., file:///etc/passwd) and submit it for conversion; the conversion process will fetch and embed the file contents into the output PNG/JPEG image. The attack requires only the ability to supply an SVG file to the converter (network reachable, no authentication required). Patches are available in versions after 0.5.0.
Affected products
- npm convert-svg-core
- npm convert-svg-to-jpeg
- npm convert-svg-to-png
Timeline
- 2022-01-21: disclosed: CVE-2021-23631 published to NVD
- 2022-01-27: advisory: GHSA-jv7g-9g6q-cxvw published