Junglewise Threat Intelligence

CVE-2021-23631: convert-svg path traversal via crafted SVG file

CVE-2021-23631 · Severity: low · CVSS 3.1 · Published 2022-01-27

Technologies: convert-svg-core (npm). Vendors: npm.

Executive brief

The convert-svg libraries are Node.js packages that transform SVG (Scalable Vector Graphics) files into PNG or JPEG images. An attacker can exploit a path traversal flaw by uploading a specially crafted SVG file that tricks the converter into reading arbitrary files from the server's file system and embedding their contents in the output image. This could expose sensitive files such as configuration files, private keys, or system credentials.

Technical details

This is a path traversal vulnerability (CWE-22) affecting convert-svg-core and its dependents convert-svg-to-png and convert-svg-to-jpeg in all versions up to 0.5.0. The vulnerability occurs because the SVG parser does not properly validate file references embedded in SVG elements (such as iframe src attributes pointing to file:// URLs). An unauthenticated attacker can craft an SVG file containing references to arbitrary file paths (e.g., file:///etc/passwd) and submit it for conversion; the conversion process will fetch and embed the file contents into the output PNG/JPEG image. The attack requires only the ability to supply an SVG file to the converter (network reachable, no authentication required). Patches are available in versions after 0.5.0.

Affected products

  • npm convert-svg-core
  • npm convert-svg-to-jpeg
  • npm convert-svg-to-png

Timeline

  • 2022-01-21: disclosed: CVE-2021-23631 published to NVD
  • 2022-01-27: advisory: GHSA-jv7g-9g6q-cxvw published

References

Related threats