Directory Traversal

Vulnerability

The vulnerability in convert-svg-core (versions before 0.6.4) arises from improper sanitization of SVG tags. The library only sanitizes the first SVG element in the input, allowing attackers to bypass security measures by inserting a dummy ` element before the malicious payload [1][2]. This enables directory traversal, as a crafted SVG can include an onfocus` event handler with JavaScript that reads arbitrary files from the server filesystem [2].

Exploitation

To exploit the vulnerability, an attacker supplies a specially crafted SVG file to the conversion function. The proof-of-concept in reference [2] uses multiple SVG elements; the dummy ` passes the sanitization check, while subsequent malicious elements containing an onfocus event with base64-encoded JavaScript execute in the headless Chromium browser used by the library. The payload can include an iframe with src="file:///etc/passwd"`, enabling file read [2]. No authentication is required; the attacker only needs the ability to provide SVG content to the conversion process.

Impact

Successful exploitation allows an attacker to read sensitive files from the server, such as /etc/passwd, potentially leading to information disclosure and further compromise of the host [2][4]. The directory traversal can be used to access application source code, configuration files, and other critical system files [4].

Mitigation

The issue is fixed in version 0.6.4, where the library now processes only the first SVG element from the input, preventing the bypass through multiple elements [3][4]. Users are advised to upgrade immediately.