Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Date: 2023-07
Affected: composer/statamic/cms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-36828
CWE: CWE-79
CVSS: 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L)

Antlers sanitizer cannot effectively sanitize malicious SVG ### Summary The SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform XSS attacks using SVG, even when using the `sanitize` function. ### Details Regarding the previous discussion mentioned [here](https://github.com/statamic/cms/security/advisories/GHSA-jvw9-rrc5-39g6#advisory-comment-84322), it has been identified that the default blacklist in the **FilesFieldtypeController** (located at this [link](https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15)) only blocks certain file extensions such as php, php3, php4, php5, and phtml. This allows a malicious user to upload a manipulated SVG file disguised as a social media icon, potentially triggering an XSS vulnerability. ### PoC Screenshot ![image](https://user-images.githubusercontent.com/17494868/251093022-15f949e9-2014-4069-850b-81940076745e.png) ### PoC 1. Create new Global set, let's say "Settings" 2. Create a "Grid" field in Blueprint (named: social), then add somefields Name (text), URL (text) and Icon (Assets) in the section Fields. 3. When calling the social setting in the `_footer.antlers.html`, remember to [sanitize](https://statamic.dev/modifiers/sanitize) ``` {{ settings:social }} <a href="{{ $url }}" class="ml-4" aria-label="{{ $name }}" rel="noopener"> {{ svg :src="icon" class="h-6 w-6 hover:text


Mitigations:

Architectural layers (MAESTRO):