CVE-2022-24429
📋 TL;DR
CVE-2022-24429 is an arbitrary code injection vulnerability in convert-svg-core that allows attackers to read arbitrary files from the file system when processing specially crafted SVG files. The vulnerability affects applications that use convert-svg-core to convert SVG files to PNG format. Attackers can exfiltrate sensitive file contents through the converted PNG output.
💻 Affected Systems
- convert-svg-core
📦 What is this software?
Convert Svg Core by Convert Svg Core Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file read leading to credential theft, configuration exposure, and potential privilege escalation to remote code execution.
Likely Case
Sensitive file disclosure including configuration files, environment variables, and source code from the server filesystem.
If Mitigated
Limited impact with proper input validation and file access restrictions in place.
🎯 Exploit Status
Exploitation requires only a malicious SVG file upload. Proof-of-concept examples are available in public GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.3 and later
Vendor Advisory: https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1
Restart Required: Yes
Instructions:
1. Update convert-svg-core to version 0.6.3 or later using npm update convert-svg-core. 2. Restart the application. 3. Verify the fix by checking the package version.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation of SVG file inputs before processing
File access restrictions
linuxRun the application with minimal file system permissions
chmod -R 750 /path/to/app
chown -R appuser:appgroup /path/to/app
🧯 If You Can't Patch
- Disable SVG file processing functionality entirely
- Implement a web application firewall (WAF) with rules to block malicious SVG payloads
🔍 How to Verify
Check if Vulnerable:
Check package.json for convert-svg-core version. If version is less than 0.6.3, the system is vulnerable.Check Version:
npm list convert-svg-coreVerify Fix Applied:
Verify convert-svg-core version is 0.6.3 or higher and test with known malicious SVG files.📡 Detection & Monitoring
Log Indicators:
- Unusual file read operations from convert-svg-core process
- Large PNG file generation from small SVG inputs
- Error logs showing file access violations
Network Indicators:
- Unusual outbound data transfers following SVG file uploads
- PNG files containing non-image data patterns
SIEM Query:
process.name:"node" AND file.path:"*convert-svg*" AND file.operation:"read" AND NOT file.path:"*node_modules*"🔗 References
- https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1
- https://github.com/neocotic/convert-svg/issues/84
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212
- https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1
- https://github.com/neocotic/convert-svg/issues/84
- https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212
