Remote Code Injection vulnerable about convert-svg

[neocotic]

I've release 0.6.3 with additional logic that effectively strips all but a subset of the standard SVG element attributes which excludes event attributes and the src attribute.

Please can you take another look and see if you can reproduce any remote code injection attacks with the latest version?

[domdom2y2]

I think you should prevent it with whitelisted tag or attributes. No need to allow all the event handling attributes. There are a lots of event handling attributes at svg tag. For example, onload, onfocus, onerror, onstart, onend, ... etc.
Try look at this link. https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/Events

[domdom2y2]

@neocotic

[neocotic]

Thanks. I'll try to take a look at this ASAP but busy over the weekend so it might be next week.

I agree that an allow list is most likely the safest option so I'll try to take care that this is comprehensive and well documented. Additionally, I want to see if there's a way of inspecting SVG files loaded via src instead of outright ignoring/rejecting that attribute, given that it currently circumvents existing protections. It'll likely ignored/rejected initially for safety but I hope to add support for it back if I can find a way of checking the resource loads via Puppeteer.

Thanks again for looking into this further.

[domdom2y2]

Okay I will. By the way, this bug is assigned to CVE-2022-24429.

[domdom2y2]

I found another issue, I will create new issue for this.