CVE-2024-25117: Vulnerability in phenx/php-svg-lib - Lack of Path Validation on Font through SVG Inline Styles
Summary
CVE-2024-25117: php-svg-lib lacks path validation on font through SVG inline styles. Affects phenx/php-svg-lib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- php-dompdf-svg-lib · Debian:12
The same CVE-2024-25117 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phenx/php-svg-lib is an open-source library available on Packagist. It provides functionality for working with Scalable Vector Graphics (SVG) in PHP applications. SVG is a widely used XML-based vector image format that allows for the creation of interactive and dynamic graphics. The library allows developers to generate and manipulate SVG images programmatically. However, a vulnerability has been discovered in the library that could potentially lead to remote code execution (RCE) or bypass of restrictions if not properly mitigated.
Vulnerability Detail
The vulnerability in phenx/php-svg-lib arises from a lack of path validation on the font-family attribute through SVG inline styles. The library fails to validate that the font-family attribute does not contain a PHAR URL, which can be exploited to execute arbitrary PHP code on versions prior to PHP 8.0. Additionally, the library does not validate if external references are allowed, which can lead to bypassing of restrictions or RCE on projects that use it. This vulnerability can be exploited if the fontName passed by php-svg-lib is not strictly revalidated by the consuming application. An attacker can craft a malicious SVG file with a font-family attribute containing a PHAR URL, leading to the execution of arbitrary code when processed by the library.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
composer require phenx/php-svg-lib:0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of phenx/php-svg-lib is not immediately feasible, a temporary workaround is to manually validate and sanitize the fontName value before passing it to the library. This can be done by implementing custom validation logic that checks for the presence of PHAR URLs or any other potentially dangerous content in the font-family attribute.
Conclusion
The vulnerability in phenx/php-svg-lib can potentially lead to bypassing of restrictions or remote code execution (RCE) if not properly mitigated. It is crucial to update to the latest version of the library and ensure that the fontName value passed by php-svg-lib is thoroughly validated and sanitized in the consuming application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for phenx/php-svg-lib →
FAQ
phenx/php-svg-lib is an open-source library for working with SVG in PHP applications. It provides functionality for generating and manipulating SVG images programmatically.
The impact of this vulnerability can range from bypassing of restrictions to remote code execution (RCE) on projects that use phenx/php-svg-lib. It depends on how the library is used and whether the consuming application properly validates the fontName value passed by php-svg-lib.
To mitigate this vulnerability, it is recommended to update to version 0.5.2 or later of phenx/php-svg-lib. Additionally, ensure that the fontName value passed by php-svg-lib is properly validated and sanitized in the consuming application.
A temporary workaround is to manually validate and sanitize the fontName value before passing it to the library. This can be done by implementing custom validation logic that checks for the presence of PHAR URLs or any other potentially dangerous content in the font-family attribute.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-f3qr-qr4x-j273/GHSA-f3qr-qr4x-j273.json
References
Related vulnerabilities
Recent vulnerabilities recorded for phenx/php-svg-lib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
