CVE-2022-24718
📋 TL;DR
CVE-2022-24718 is a path traversal vulnerability in ssr-pages, an HTML page builder for server-side rendering. When untrusted input is passed to the 'svg' property in the build() function, attackers can read arbitrary files from the server. This affects all applications using ssr-pages versions before 0.1.4.
💻 Affected Systems
- ssr-pages
📦 What is this software?
Ssr Pages by Finastra
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system compromise, allowing attackers to read sensitive files like configuration files, credentials, and source code, potentially leading to further system compromise.
Likely Case
Unauthorized file disclosure from the server, potentially exposing sensitive application data, configuration files, or user information.
If Mitigated
No impact if input validation prevents path traversal sequences or if the application doesn't process untrusted SVG input.
🎯 Exploit Status
Exploitation requires the application to accept untrusted SVG input, but the vulnerability itself is straightforward path traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.4
Vendor Advisory: https://github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8
Restart Required: Yes
Instructions:
1. Update ssr-pages to version 0.1.4 or later using npm: npm update ssr-pages
2. Restart the application server
3. Verify the fix by checking the package.json version
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to reject any SVG input containing path traversal sequences like '../' or absolute paths.
🧯 If You Can't Patch
- Implement strict input validation to sanitize SVG input and reject path traversal sequences.
- Restrict SVG input processing to trusted sources only and implement file access controls.
🔍 How to Verify
Check if Vulnerable:
Check package.json for ssr-pages version. If version is less than 0.1.4, the system is vulnerable.Check Version:
npm list ssr-pagesVerify Fix Applied:
Verify ssr-pages version is 0.1.4 or higher in package.json and test that path traversal attempts in SVG input are rejected.📡 Detection & Monitoring
Log Indicators:
- Failed file access attempts with path traversal patterns in SVG processing
- Unusual file read operations from web application context
Network Indicators:
- HTTP requests containing '../' or similar patterns in SVG parameters
- Unusual file read patterns from application endpoints
SIEM Query:
source="web_server" AND (uri="*svg*" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*"))🔗 References
- https://github.com/Finastra/ssr-pages/pull/1
- https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780
- https://github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8
- https://github.com/Finastra/ssr-pages/pull/1
- https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780
- https://github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8
