CVE-2018-7265 - Stored XSS vulnerability resulting from improper handling of uploaded SVG files

[Alyssa-o-Herrera]

During testing of your project, I came across a stored XSS vulnerability that stems from lack of sanitizing and checking integrity of SVG files being uploaded to the server
Reproduction is quite easy as all it requires is going to the image upload feature, then selecting our crafted svg file then visiting the full image to receive the alert.
Svg file code:
https://ghostbin.com/paste/xkj2o

[shish]

By "visiting the full image" I assume you mean the image URL is in the browser address bar (As opposed to visiting the page which embeds the image?). We're using <img> rather than <embed> which is supposed to stop scripts, but you're right that if the user views the file directly instead of inside HTML, then the browser would treat that as an interactive document...

I'll get researching mitigations for that, though suggestions are welcome if you know of any off the top of your head. Thanks for the report either way :)

[Alyssa-o-Herrera]

paragonie/airship@7c9df9a Is how they handled svg files executing JS. Yes, the embedded page on it's own won't execute but seeing the image directly would allow execution of JS in the context of DOM. I'll be requesting a CVE for this issue as well.

[Alyssa-o-Herrera]

This has been assigned CVE-2018-7265

[shish]

I believe this to be fixed in the develop branch in bc68137:

Uploaded file:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" width="100" height="100">
    <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
    <script type="text/javascript">
        alert(document.location);
    </script>
</svg>

File served to users:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" baseProfile="full" width="100" height="100">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"></polygon>
</svg>

Backported to master in 60d693d

[Alyssa-o-Herrera]

Alright I'll check if it's possible to bypass the solution or not.

[Alyssa-o-Herrera]

Seems secure. I did some testing against the sanitize and I wasn't able to effectively come up with a manner to exploit it.

[shish]

Cool, thanks again for making the world a safer place :)