CVE-2023-27586 (published 2023-03-20T16:15Z)

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/Kozea/CairoSVG
commit_details: repo_url: https://github.com/Kozea/CairoSVG
author: Guillaume Ayoub
author_date: 2023-03-10 16:11:22+01:00
msg: Don’t allow fetching external files unless explicitly asked for
repository: repo_url: https://github.com/Kozea/CairoSVG
repo_name: Kozea/CairoSVG
description: Convert your vector images
repo_language: Python
owner: Kozea
file_changes: filename: __main__.py
change_type: ModificationType.MODIFY
diff: @@ -42,8 +42,8 @@ def main(argv=None, stdout=None, stdin=None):
         help='replace every raster pixel with its complementary color')
     parser.add_argument(
         '-u', '--unsafe', action='store_true',
-        help='resolve XML entities and allow very large files '
-             '(WARNING: vulnerable to XXE attacks and various DoS)')
+        help='fetch external files, resolve XML entities and allow very large '
+             'files (WARNING: vulnerable to XXE attacks and various DoS)')
     parser.add_argument(
         '--output-width', default=None, type=float,
         help='desired output width in pixels')

programming_language: Python
filename: parser.py
change_type: ModificationType.MODIFY
diff: @@ -390,6 +390,12 @@ class Tree(Node):
             tree = ElementTree.fromstring(
                 bytestring, forbid_entities=not unsafe,
                 forbid_external=not unsafe)
+
+        # Don’t allow fetching external files unless explicitly asked for
+        if 'url_fetcher' not in kwargs and not unsafe:
+            self.url_fetcher = (
+                lambda *args, **kwargs: b'<svg width="1" height="1"></svg>')
+
         self.xml_tree = tree
         root = cssselect2.ElementWrapper.from_xml_root(tree)
         style = parent.style if parent else css.parse_stylesheets(self, url)

programming_language: Python
filename: surface.py
change_type: ModificationType.MODIFY
diff: @@ -113,7 +113,8 @@ class Surface(object):
         :param parent_width: The width of the parent container in pixels.
         :param parent_height: The height of the parent container in pixels.
         :param scale: The ouptut scaling factor.
-        :param unsafe: A boolean allowing XML entities and very large files
+        :param unsafe: A boolean allowing external file access, XML entities
+                       and very large files
                        (WARNING: vulnerable to XXE attacks and various DoS).
 
         Specifiy the output with:

programming_language: Python
repo_url: https://github.com/Kozea/CairoSVG
commit_details: repo_url: https://github.com/Kozea/CairoSVG
author: Guillaume Ayoub
author_date: 2023-03-20 15:26:08+01:00
msg: Version 2.7.0
repository: repo_url: https://github.com/Kozea/CairoSVG
repo_name: Kozea/CairoSVG
description: Convert your vector images
repo_language: Python
owner: Kozea
file_changes: filename: NEWS.rst
change_type: ModificationType.MODIFY
diff: @@ -3,6 +3,18 @@
 ======
 
 
+Version 2.7.0 released on 2023-03-20
+====================================
+
+**WARNING:** this is a security update.
+
+When processing SVG files, CairoSVG could access other files online, possibly
+leading to very long renderings or other security problems.
+
+This feature is now disabled by default. External resources can still be
+accessed using the "unsafe" or the "url_fetcher" parameter.
+
+
 Version 2.6.0 released on 2023-01-12
 ====================================
 

programming_language: Markdown
filename: VERSION
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-2.6.0
\ No newline at end of file
+2.7.0
\ No newline at end of file

programming_language: SQL