CVE-2023-27586
📋 TL;DR
CVE-2023-27586 is a server-side request forgery (SSRF) vulnerability in CairoSVG that allows attackers to make unauthorized network requests from vulnerable systems. When processing malicious SVG files, CairoSVG can send requests to external hosts, potentially enabling data exfiltration, internal network scanning, or denial of service. This affects any application or service using vulnerable versions of CairoSVG to process SVG files.
💻 Affected Systems
- CairoSVG
📦 What is this software?
Cairosvg by Courtbouillon
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via SSRF to internal services, data exfiltration, or denial of service through resource exhaustion.
Likely Case
Unauthorized network requests to internal or external systems, potentially exposing sensitive data or enabling further attacks.
If Mitigated
Limited impact with proper network segmentation and input validation, but still poses risk if SVG processing is exposed.
🎯 Exploit Status
Exploitation requires only a malicious SVG file. Public proof-of-concept exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.0
Vendor Advisory: https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv
Restart Required: No
Instructions:
1. Update CairoSVG to version 2.7.0 or later using pip: pip install --upgrade CairoSVG>=2.7.0
2. Verify the update with: pip show CairoSVG
3. Test SVG processing functionality after update.
🔧 Temporary Workarounds
Disable network access for CairoSVG
allConfigure CairoSVG to disable network requests by setting appropriate environment variables or configuration.
export CAIROSVG_NO_NETWORK=1
Input validation and sanitization
allImplement strict input validation to reject SVG files containing external references or suspicious URLs.
🧯 If You Can't Patch
- Implement network segmentation to restrict CairoSVG's outbound network access
- Deploy web application firewall (WAF) rules to block SVG files with external references
🔍 How to Verify
Check if Vulnerable:
Check CairoSVG version: pip show CairoSVG | grep Version. If version is below 2.7.0, system is vulnerable.Check Version:
pip show CairoSVG | grep VersionVerify Fix Applied:
Verify CairoSVG version is 2.7.0 or higher: pip show CairoSVG | grep Version. Test with known malicious SVG to confirm no network requests are made.📡 Detection & Monitoring
Log Indicators:
- Unexpected outbound network connections from CairoSVG process
- Failed SVG processing attempts with external URLs
Network Indicators:
- Outbound HTTP/HTTPS requests from CairoSVG to unexpected destinations
- DNS queries for external domains during SVG processing
SIEM Query:
process_name:"python" AND (process_cmdline:"cairosvg" OR process_cmdline:"CairoSVG") AND (network_direction:outbound AND NOT network_destination:expected_domains)🔗 References
- https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255
- https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53
- https://github.com/Kozea/CairoSVG/releases/tag/2.7.0
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv
- https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255
- https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53
- https://github.com/Kozea/CairoSVG/releases/tag/2.7.0
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv
