CVE-2021-23631
📋 TL;DR
This vulnerability in convert-svg-core, convert-svg-to-png, and convert-svg-to-jpeg packages allows attackers to read arbitrary files from the server's file system by uploading specially crafted SVG files. The file contents are then exposed in the converted PNG/JPEG output. Any application using these vulnerable packages for SVG conversion is affected.
💻 Affected Systems
- convert-svg-core
- convert-svg-to-png
- convert-svg-to-jpeg
📦 What is this software?
Convert Svg Core by Convert Svg Core Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, credentials, and private data, potentially leading to full system compromise.
Likely Case
Unauthorized access to sensitive files containing application secrets, configuration data, or user information stored on the server.
If Mitigated
Limited file access restricted by application permissions and file system controls, with monitoring detecting suspicious file read attempts.
🎯 Exploit Status
Proof of concept available in public gist. Exploitation requires only SVG file upload capability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: convert-svg-core 0.6.4, convert-svg-to-png 1.1.7, convert-svg-to-jpeg 1.1.7
Vendor Advisory: https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14
Restart Required: Yes
Instructions:
1. Update package.json to use patched versions. 2. Run 'npm update convert-svg-core convert-svg-to-png convert-svg-to-jpeg'. 3. Restart the application.
🔧 Temporary Workarounds
Disable SVG upload functionality
allTemporarily disable SVG file uploads until patching is complete
Implement strict file validation
allValidate SVG files for malicious content before processing
🧯 If You Can't Patch
- Implement strict input validation and sanitization for SVG files
- Run vulnerable packages in isolated containers with restricted file system access
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for vulnerable package versions. Run 'npm list convert-svg-core convert-svg-to-png convert-svg-to-jpeg'.Check Version:
npm list convert-svg-core convert-svg-to-png convert-svg-to-jpegVerify Fix Applied:
Verify installed versions are >= convert-svg-core 0.6.4, convert-svg-to-png 1.1.7, convert-svg-to-jpeg 1.1.7 using 'npm list'.📡 Detection & Monitoring
Log Indicators:
- Unusual file read patterns from SVG conversion processes
- Large or abnormal PNG/JPEG output sizes
- Failed SVG conversion attempts with file paths
Network Indicators:
- SVG file uploads followed by PNG/JPEG downloads containing text data
- Unusual file content in converted images
SIEM Query:
source="application_logs" AND ("convert-svg" OR "svg conversion") AND ("error" OR "failed" OR "unexpected")🔗 References
- https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-1582785
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOJPEG-2348245
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOPNG-2348244
- https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-1582785
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOJPEG-2348245
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOPNG-2348244
