com.caverock:androidsvg@1.2.1 XXE injection

[deadjdona]

Description

XML External Entity (XXE) Injection
Vulnerable module: com.caverock:androidsvg
Introduced through: com.caverock:androidsvg@1.2.1
Exploit maturity: No known exploit
Fixed in: 1.3.0
Detailed paths and remediation
Introduced through: project@0.0.0 › com.caverock:androidsvg@1.2.1

Reproduction

Solution

Remediation: Upgrade to com.caverock:androidsvg@1.3

Additional Information

• Fresco version: latest
• Platform version: android

Overview

com.caverock.androidsvg is a SVG parser and renderer for Android.
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the SVG parsing component

[oprisnik]

Thanks for the report. It's only used in our sample app and not in Fresco itself. I'll update the lib shortly.

[oprisnik]

Fixed with 3a92142