Executive brief
convert-svg-core is a Node.js library that converts SVG graphics into other formats using headless Chromium. A directory traversal vulnerability allows attackers to read arbitrary files from the server filesystem by crafting a malicious SVG file with path traversal sequences. This could expose sensitive configuration files, source code, or system files.
Technical details
The vulnerability exists in convert-svg-core's SVG tag processing logic due to improper input sanitization. An attacker can craft an SVG file containing directory traversal sequences (e.g., "../") or absolute paths that bypass the library's security measures. When this malicious SVG is processed, the library fails to properly restrict file access and allows reading arbitrary files from the filesystem. The fix, released in version 0.6.4, ensures that only the first SVG element from input is converted and applies proper sanitization to all SVG elements. No authentication is required to exploit this vulnerability—it affects any application using a vulnerable version of convert-svg-core to process untrusted SVG input.
Affected products
- neocotic convert-svg-core <0.6.4
Timeline
- 2022-06-10: disclosed: CVE published on NVD
- 2022-06-11: disclosed: GHSA advisory published
- 2022-06-07: patched: Fix merged in commit 2bbc498; version 0.6.4 released