CVE-2017-1000498: AndroidSVG XML External Entity (XXE) Vulnerability
Summary
CVE-2017-1000498: Android SVG vulnerable to XML External Entity (XXE). Affects com.caverock:androidsvg versions < 1.3. Fixed in 1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AndroidSVG is a library for rendering SVG files on Android devices. It provides a convenient way to display scalable vector graphics in Android applications. The library is widely used in various Android projects and is available through the Maven ecosystem. However, AndroidSVG version 1.2.2 is vulnerable to XML External Entity (XXE) attacks in the SVG parsing component. This vulnerability can lead to denial of service and potentially remote code execution.
Vulnerability Detail
The AndroidSVG library, specifically version 1.2.2, is susceptible to XML External Entity (XXE) attacks. This type of attack occurs when an XML parser processes external entities defined in the XML document. An attacker can exploit this vulnerability by crafting a malicious SVG file that includes an external entity reference pointing to a sensitive file or a remote resource. When the SVG file is parsed by AndroidSVG, the parser will attempt to resolve the external entity, leading to potential information disclosure, denial of service, or even remote code execution.
How To Fix
Minimum fixed version
1.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization measures to mitigate the risk of XXE attacks. This can involve validating and restricting the input SVG files to ensure they do not contain any external entity references. Additionally, it is advisable to use a secure XML parser that disables external entity resolution by default.
Conclusion
The AndroidSVG library version 1.2.2 is vulnerable to XML External Entity (XXE) attacks, which can lead to denial of service and potentially remote code execution. It is crucial for developers to upgrade to a fixed version of the library (1.3 or later) and ensure their project's dependencies are up to date. Implementing input validation and using a secure XML parser can provide temporary mitigation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.caverock:androidsvg →
FAQ
AndroidSVG is a library for rendering SVG files on Android devices. It provides a convenient way to display scalable vector graphics in Android applications.
An XML External Entity (XXE) attack is a type of security vulnerability that occurs when an XML parser processes external entities defined in the XML document. It can lead to information disclosure, denial of service, or remote code execution.
AndroidSVG version 1.2.2 is vulnerable to XML External Entity (XXE) attacks.
This vulnerability can result in denial of service and potentially remote code execution on Android devices using the affected version of AndroidSVG.
To fix this vulnerability, you should upgrade to a fixed version of the AndroidSVG library (version 1.3 or later). Update your project's dependencies to use the latest secure version of the library.
