CVE-2017-5617 Server Side Request Forgery in svgSalamander
Remote attackers can perform server-side request forgery via SVG xlink:href attributes in applications using the SVG Salamander library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-5617?
CVE-2017-5617 is a high-severity server-side request forgery vulnerability in Debian Debian Linux, published on 16 Mar 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
Weakness: CWE-918
Which versions are affected by CVE-2017-5617?
2 open source packages ship an affected version, including com.kitfox.svg:svg-salamander. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.kitfox.svg:svg-salamander Maven | All versions | 1.1.2 |
com.kitfox.svg:svg-salamander Maven | All versions | 1.1.2 |
Products include Debian Debian Linux, Kitfox Svg Salamander.
How do I fix CVE-2017-5617?
Upgrade com.kitfox.svg:svg-salamander to 1.1.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-5617 being exploited?
There is no known exploitation of CVE-2017-5617 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2017-5617, DLA-816-1, DSA-3781-1, GHSA-h3wv-47xm-4mg6, MGASA-2019-0160, UBUNTU-CVE-2017-5617.