CVE-2023-27586: CairoSVG SSRF Vulnerability Explained

CVE-2023-27586 Overview

CairoSVG is a popular SVG converter based on Cairo, a 2D graphics library written in Python. Prior to version 2.7.0, CairoSVG can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a Server-Side Request Forgery (SSRF) attack or cause a Denial of Service (DoS). This vulnerability arises from improper input validation when handling external resource references within SVG documents.

Critical Impact
Attackers can leverage malicious SVG files to force the server to make unauthorized requests to internal or external resources, potentially exposing sensitive data or disrupting service availability.

Affected Products

Courtbouillon CairoSVG versions prior to 2.7.0

Discovery Timeline

2023-03-20 - CVE-2023-27586 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-27586

Vulnerability Analysis

This vulnerability combines two dangerous weakness classes: Improper Input Validation (CWE-20) and Server-Side Request Forgery (CWE-918). When CairoSVG processes an SVG file, it follows external resource references embedded within the document without proper validation or restriction. This design flaw allows attackers to craft malicious SVG files containing references to arbitrary URLs, which the server will then fetch during the conversion process.

The attack requires local access and user interaction—specifically, a user or application must process the malicious SVG file. Upon processing, the vulnerable CairoSVG instance will make HTTP requests to attacker-specified endpoints, potentially reaching internal services that should not be publicly accessible. The vulnerability can lead to high confidentiality impact through SSRF-based data exfiltration and high availability impact through resource exhaustion or service disruption.

Root Cause

The root cause lies in CairoSVG's default behavior of allowing external resource fetching during SVG processing. The library did not implement adequate restrictions on outbound network requests, enabling SVG files to reference and retrieve content from arbitrary URLs. This lack of input sanitization on URL references created an avenue for SSRF attacks, where the server can be tricked into accessing resources on behalf of an attacker.

Attack Vector

The attack vector is local, requiring user interaction to process a malicious SVG file. An attacker would craft an SVG document containing external resource references (such as <image> tags with href attributes pointing to internal IP addresses or sensitive external endpoints). When this file is processed by a vulnerable CairoSVG instance, the library makes HTTP requests to fetch these resources.

For SSRF exploitation, attackers can target internal services like http://localhost:8080/admin or cloud metadata endpoints like http://169.254.169.254/. For denial of service, the SVG can reference extremely large files or slow-responding servers, exhausting system resources during conversion.

The vulnerability mechanism involves CairoSVG's URL handling during SVG parsing. When an SVG contains external references, the library attempts to fetch these resources without validating whether the target is safe or authorized. Version 2.7.0 addresses this by disabling the ability to access online files by default. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2023-27586

Indicators of Compromise

Unexpected outbound HTTP/HTTPS requests originating from processes running CairoSVG
Network connections to internal IP addresses (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) from SVG processing services
Access logs showing requests to cloud metadata endpoints (e.g., 169.254.169.254)
SVG files containing suspicious href, xlink:href, or external resource references

Detection Strategies

Monitor network traffic for unusual outbound connections from application servers processing SVG files
Implement application-level logging to capture URLs requested during SVG processing
Use web application firewalls (WAF) to inspect incoming SVG files for external URL references
Deploy file upload scanning solutions to detect potentially malicious SVG content before processing

Monitoring Recommendations

Enable verbose logging in CairoSVG deployments to track resource fetching behavior
Set up network monitoring alerts for connections to RFC 1918 private IP ranges from web-facing services
Implement egress filtering to restrict outbound connections from servers that process user-supplied content
Regularly audit SVG processing workflows for unexpected network activity

How to Mitigate CVE-2023-27586

Immediate Actions Required

Upgrade CairoSVG to version 2.7.0 or later immediately
Audit existing deployments to identify all instances of CairoSVG in use
Implement network segmentation to limit the impact of potential SSRF attacks
Review recent SVG processing logs for signs of exploitation attempts

Patch Information

The vulnerability is addressed in CairoSVG version 2.7.0, which disables the ability to access online files by default. The fix has been implemented through two commits:

The official release is available at the CairoSVG 2.7.0 Release page.

Workarounds

If immediate upgrade is not possible, implement network-level controls to block outbound requests from SVG processing services
Sanitize SVG files before processing by stripping external URL references using preprocessing scripts
Run CairoSVG in isolated network environments without access to internal services or sensitive endpoints
Consider using allowlist-based URL filtering if external resources are required for legitimate use cases

bash

# Upgrade CairoSVG to the patched version
pip install --upgrade cairosvg>=2.7.0

# Verify the installed version
pip show cairosvg | grep Version