CVE-2021-23631: Path Traversal in convert-svg packages

Background

The convert-svg package is a collection of npm packages that provide functionality for converting SVG files to other formats such as PNG and JPEG. The affected packages include convert-svg-core, convert-svg-to-png, and convert-svg-to-jpeg. These packages are widely used for converting SVG files in various applications.

Vulnerability Detail

The vulnerability (CVE-2021-23631) allows an attacker to perform path traversal attacks by exploiting a flaw in the convert-svg packages. By providing a specially crafted SVG file, an attacker can read arbitrary files from the file system. The attacker can then display the content of these files as converted PNG files. This can lead to unauthorized access to sensitive information and potential data breaches.

Workaround

If updating the packages is not immediately feasible, a temporary workaround is to implement input validation and sanitization for SVG files. This can help prevent the exploitation of the path traversal vulnerability. Here is an example of how to validate and sanitize SVG file paths in Node.js:

const path = require('path');

function sanitizeSvgPath(filePath) {
  const baseDir = '/path/to/svgs'; // Set the base directory for SVG files
  const resolvedPath = path.resolve(baseDir, filePath);

  if (!resolvedPath.startsWith(baseDir)) {
    throw new Error('Invalid SVG file path');
  }

  return resolvedPath;
}

This code snippet ensures that the resolved file path is within the specified base directory, preventing any attempts to traverse outside of it.

Conclusion

The path traversal vulnerability in the convert-svg packages (convert-svg-core, convert-svg-to-png, and convert-svg-to-jpeg) can allow an attacker to read arbitrary files from the file system. It is crucial to update the packages to the latest patched versions (0.5.1 or higher) to mitigate this vulnerability. Additionally, implementing input validation and sanitization for SVG file paths can provide a temporary workaround until the packages are updated. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for convert-svg-core →

FAQ