CVE-2023-50252
Published: 12 December 2023
Summary
CVE-2023-50252 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Dompdf Php-Svg-Lib. Its CVSS base score is 8.3 (High).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
php-svg-lib is an SVG file parsing and rendering library that prior to version 0.5.1 contained a flaw in its handling of <use> tags referencing <image> tags. The library merges attributes from the <use> element onto the referenced <image> element without sanitizing the href attribute, which can result in an unsafe file read that triggers PHAR deserialization when the library is used with PHP versions earlier than 8. The issue is tracked under CWE-15 and CWE-502 and carries a CVSS 3.1 score of 8.3.
An unauthenticated remote attacker can supply a crafted SVG document containing a malicious <use> reference. When the document is processed by a vulnerable application, the attacker can cause arbitrary file reads on the server and potentially execute code through PHP object deserialization, all without user interaction.
The project addressed the flaw in release 0.5.1; the corresponding patch is available in commit 08ce6a96d63ad7216315fae34a61c886dd2dc030 and is described in GitHub Security Advisory GHSA-jq98-9543-m4cr. The EPSS score has remained essentially flat near 0.1 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55067
Vulnerability details
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when…
more
the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.
Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.
Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.
Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.
Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.
Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.
The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.