CVE-2019-12921

Vulnerability

In GraphicsMagick before 1.3.32, the TranslateTextEx function used for processing text filenames in SVG images does not properly escape single quotes and handles the @ character to read local files. This allows injection of MVG commands through the SVG coder [2].

Exploitation

An attacker can craft an SVG file with a malicious xlink:href attribute that includes a single quote to break out of the string and inject MVG text primitives, using @ to read arbitrary local files. The exploit can be triggered by converting the SVG to another format (e.g., gm convert exploit.svg output.png). No authentication is required; only processing of the crafted image is needed [2].

Impact

Successful exploitation allows an attacker to read arbitrary files on the system, leading to information disclosure. The attacker gains access to sensitive file contents (e.g., /etc/passwd) [2].

Mitigation

Upgrade to GraphicsMagick 1.3.32 or later, which fixes the issue. If upgrading is not possible, avoid processing untrusted SVG files [1][2].