Critical Java Code Execution Vulnerability in Apache Batik
Summary
CVE-2022-42890: A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. Affects batik across 2 version ranges.
< 1.12-4+deb11u1
>= 1b708df57205a70c2c9fb8235ff5eab837609968, < 8e94aaaf3872a670040c6faebe82c907cb380fad
Fixed in 1.12-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Batik is a powerful toolkit for working with SVG (Scalable Vector Graphics) in Java. It allows developers to create, manipulate, and render SVG content. However, prior to version 1.16, Batik had a significant vulnerability that could allow untrusted SVG files to execute arbitrary Java code via JavaScript, posing a serious security risk to applications using this library.
Vulnerability Detail
The vulnerability identified as CVE-2022-42890 allows an attacker to exploit the Batik library by embedding malicious JavaScript within SVG files. When these SVG files are processed by an application using Batik, the untrusted JavaScript can execute Java code, potentially leading to unauthorized access, data manipulation, or system compromise. This vulnerability affects all versions of Apache Batik prior to 1.16, making it critical for users to upgrade to the latest version to mitigate risks.
How To Fix
Minimum fixed version
1.12-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade batikTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing strict input validation to sanitize SVG files before processing them with Batik. This can help mitigate the risk of executing malicious JavaScript. Additionally, avoid processing SVG files from untrusted sources.
Conclusion
The CVE-2022-42890 vulnerability in Apache Batik poses a significant risk by allowing untrusted SVG files to execute arbitrary Java code. Users are strongly advised to upgrade to version 1.16 or later to mitigate this risk. Implementing input validation and using tools like Vulert can help monitor and protect against such vulnerabilities.
See every vulnerability recorded for batik →
FAQ
CVE-2022-42890 is a vulnerability in Apache Batik that allows untrusted SVG files to execute arbitrary Java code via JavaScript.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can identify if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access, data manipulation, or even complete system compromise, depending on the permissions of the application using Batik.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2022-42890 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for batik.
