GitHub Advisoryadvisory · Packagist

GHSA-f3qr-qr4x-j273 php-svg-lib lacks path validation on font through SVG inline styles

MEDIUM Published 2024-02-21 Modified 2024-02-21 Official page ↗
Aliases
CVE-2024-25117
Ecosystem
Packagist
Packages
phenx/php-svg-lib
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-502, CWE-610, CWE-73
Reviewed
2024-02-21

Affected packages

• Packagist phenx/php-svg-lib: < 0.5.2 → fixed in 0.5.2

Description

Summary php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP href, 0, 7)) === "phar://" || ($this->document->allowExternalReferences === false && \strtolower(\substr($this->href, 0, 5)) !== "data:") ) ) { unset($style["font-family"]); } ``` PoC Parsing the following SVG : ``` My ``` will pass the `phar:///path/to/whatever.phar/blaklis` as `$family` in `SurfaceCpdf::setFont`, which is then passed to the canvas `selectFont` as a `$fontName`. Impact Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the `fontName` that is passed by php-svg-lib

Related

Alias · CVE (1)

  • CVE-2024-25117 php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. vulnerability

Weakness · CWE (3)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness
  • CWE-73 External Control of File Name or Path weakness

References