CVE-2023-50252
📋 TL;DR
This vulnerability in php-svg-lib allows attackers to perform PHAR deserialization attacks via malicious SVG files containing unsanitized href attributes in <use> tags referencing <image> tags. This can lead to remote code execution on affected systems. The vulnerability affects PHP applications using php-svg-lib versions prior to 0.5.1 with PHP versions prior to 8.0.
💻 Affected Systems
- php-svg-lib
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Arbitrary file read leading to sensitive information disclosure and potential PHAR deserialization attacks.
If Mitigated
Limited impact with proper input validation and file system restrictions in place.
🎯 Exploit Status
Exploitation requires SVG file upload capability or SVG processing functionality. The vulnerability is well-documented with public advisories and patches.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.1
Vendor Advisory: https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr
Restart Required: No
Instructions:
1. Update php-svg-lib to version 0.5.1 or later using composer: 'composer update dompdf/php-svg-lib'. 2. Verify the update completed successfully. 3. Test SVG processing functionality.
🔧 Temporary Workarounds
Input Validation for SVG Files
allImplement strict input validation and sanitization for SVG file uploads and processing.
Disable SVG Processing
allTemporarily disable SVG file upload and processing functionality if not essential.
🧯 If You Can't Patch
- Implement strict file upload restrictions to block SVG files
- Upgrade to PHP 8.0+ to mitigate PHAR deserialization exploitation
🔍 How to Verify
Check if Vulnerable:
Check composer.json or installed packages for php-svg-lib version. Run: 'composer show dompdf/php-svg-lib'Check Version:
composer show dompdf/php-svg-lib | grep versionsVerify Fix Applied:
Verify installed version is 0.5.1 or later: 'composer show dompdf/php-svg-lib | grep versions'📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Errors in SVG parsing logs
- PHAR deserialization attempts in application logs
Network Indicators:
- SVG file uploads with suspicious href attributes
- Requests to unusual file paths following SVG uploads
SIEM Query:
source=web_logs (file_extension=svg OR content_type=image/svg+xml) AND (uri CONTAINS 'phar://' OR user_agent CONTAINS 'exploit')🔗 References
- https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030
- https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr
- https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030
- https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr
