CVE-2023-50251

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dompdf/php-svg-lib/commit/88163cbe562d9b391b3a352e54d9c89d02d77ee0	Patch
https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-ff5x-7qg5-vwf2	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dompdf:php-svg-lib:*:*:*:*:*:*:*:*

History

15 Dec 2023, 17:51

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-12 21:15

Updated : 2024-02-28 20:54

NVD link : CVE-2023-50251

Mitre link : CVE-2023-50251

CVE.ORG link : CVE-2023-50251

JSON object : View

Products Affected

dompdf

php-svg-lib

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2023-50251", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-12-12T21:15:08.453", "references": [{"url": "https://github.com/dompdf/php-svg-lib/commit/88163cbe562d9b391b3a352e54d9c89d02d77ee0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-ff5x-7qg5-vwf2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue."}, {"lang": "es", "value": "php-svg-lib es una librer\u00eda de an\u00e1lisis/representaci\u00f3n de archivos SVG. Antes de la versi\u00f3n 0.5.1, al analizar los atributos pasados a una etiqueta \"use\" dentro de un documento svg, un atacante pod\u00eda hacer que el sistema entrara en una recursividad infinita. Dependiendo de la configuraci\u00f3n del sistema y del patr\u00f3n de ataque, esto podr\u00eda agotar la memoria disponible para el proceso en ejecuci\u00f3n y/o para el propio servidor. Un atacante que env\u00eda m\u00faltiples solicitudes a un sistema para representar el payload anterior puede potencialmente causar el agotamiento de los recursos hasta el punto de que el sistema no pueda manejar la solicitud entrante. La versi\u00f3n 0.5.1 contiene un parche para este problema."}], "lastModified": "2023-12-15T17:51:25.283", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dompdf:php-svg-lib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E345BA-6667-40EB-AF3F-E279441B6C90", "versionEndExcluding": "0.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}