GHSA-cf4q-4cqr-7g7w SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

Not scored Published 22 Apr 2022

Attackers can inject malicious scripts via SVG elements in xml2rfc, leading to cross-site scripting attacks on published HTML documents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-cf4q-4cqr-7g7w?

GHSA-cf4q-4cqr-7g7w is a cross-site scripting vulnerability in xml2rfc, published on 22 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

xml2rfc allows script elements in SVG sources. In HTML output having these script elements can lead to XSS attacks.

Sample XML snippet:

&lt;artwork type=&#34;svg&#34; src=&#34;data:image/svg+xml,%3Csvg viewBox=&#39;0 0 10 10&#39; xmlns=&#39;http://www.w3.org/2000/svg&#39;%3E%3Cscript%3E window.alert(&#39;Test Alert&#39;); %3C/script%3E%3C/svg%3E&#34;&gt;
&lt;/artwork&gt;

Impact

This vulnerability impacts website that publish HTML drafts and RFCs.

Patches

This has been fixed in version 3.12.4.

Workarounds

If SVG source is self-contained within the XML, scraping script elements from SVG files.

References

https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

For more information

If you have any questions or comments about this advisory:

Open an issue in xml2rfc
Email us at [email protected]
Infrastructure and Services Vulnerability Disclosure

Which versions are affected by GHSA-cf4q-4cqr-7g7w?

2 open source packages ship an affected version, including xml2rfc.

Package	Affected	Fixed in
`xml2rfc` PyPI	All versions	`3.12.4`
`xml2rfc` PyPI	All versions	`3.12.4`

How do I fix GHSA-cf4q-4cqr-7g7w?

Upgrade xml2rfc to 3.12.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-cf4q-4cqr-7g7w being exploited?

There is no known exploitation of GHSA-cf4q-4cqr-7g7w in the wild and no public exploit code.