CVE-2023-27586

Executive Summary

CVE-2023-27586 is a critical server-side request forgery (SSRF) and denial-of-service (DoS) vulnerability in CairoSVG, an SVG-to-image conversion library used in web applications. The flaw allows a maliciously crafted SVG file to trigger outbound HTTP requests from the server processing it, enabling an attacker to probe internal networks, access cloud metadata services, or exhaust server resources. The vulnerability affects all versions prior to 2.7.0, which disables external file access by default. With a CVSS score of 9.9, this vulnerability warrants immediate remediation for any environment processing untrusted SVG input.

Technical Analysis

CairoSVG is a Python library that converts SVG (Scalable Vector Graphics) files into PNG, PDF, and other formats using the Cairo 2D graphics library. SVG is an XML-based vector image format that supports embedded references to external resources, including fonts, images, and stylesheets. These references can be specified via URLs (http://, https://, file://) that the converter resolves during rendering.

The vulnerability stems from CairoSVG's default behavior of fetching external resources referenced within SVG files. When the library processes an SVG document, it resolves external entity references and resource URLs without restricting the target hosts. A malicious actor can craft an SVG file that includes references to:

• Internal network addresses (e.g., http://169.254.169.254/ for cloud metadata endpoints)
• Local services (e.g., http://localhost:8080/)
• Arbitrary external hosts for resource exhaustion

The SSRF vector allows the attacker to leverage the target server's network position to access resources that would otherwise be unavailable from the internet. The DoS vector arises from the ability to direct the server to fetch large files, repeatedly request resources, or target slow endpoints, exhausting bandwidth and processing resources.

The NVD description notes that version 2.7.0 disables CairoSVG's ability to access other files online by default. This patch changes the default behavior to a deny-list approach — external fetches require explicit opt-in rather than being enabled by default.

No specific code-level details (function names, class names, or exact URL handling mechanisms) are provided in the NVD description or CNA title. The vulnerability class is clear, but implementation specifics remain unspecified.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class; no public PoC available):

1. Reconnaissance/Target Identification: The attacker identifies a web application that accepts SVG file uploads or processes SVG documents server-side. Common targets include image conversion APIs, document rendering services, profile picture uploaders with SVG conversion, or any application leveraging CairoSVG for thumbnail generation.

2. Triggering the Flaw: The attacker crafts a malicious SVG file containing an external resource reference. The reference is embedded in the SVG markup (e.g., within an <image> or <use> element, or as a font-face URL). The SVG file is submitted to the vulnerable application either via direct upload or by providing a URL to a malicious SVG document.

3. Payload Execution: When CairoSVG processes the SVG file, it resolves the external reference and issues an HTTP GET request to the URL specified in the SVG markup. Because no host allow-list validation is performed, the request can be directed to:

   • Internal RFC 1918 addresses (e.g., http://192.168.1.1/admin)
   • Cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/)
   • Local services bound to 127.0.0.1
   • Large file downloads designed to exhaust server memory or bandwidth

4. Post-Exploitation Impact: Successful SSRF exploitation results in:

   • Exfiltration of internal service responses (via error messages, timing side-channels, or output inclusion)
   • Access to cloud instance metadata, potentially yielding IAM credentials
   • Lateral movement within the internal network
   • Resource exhaustion leading to denial of service if the external requests target large or slow resources

Given the CVSS score of 9.9 (dropping to 9.8 in practical scenarios if confidentiality subscore is reduced), the vulnerability requires no authentication, no user interaction, and no special privileges. The attack vector is network-based and can be executed remotely.

Impact Assessment

Business Impact: This vulnerability poses a critical risk to any organization running a web-facing service that processes SVG files using CairoSVG versions prior to 2.7.0. The impact spans:

• Confidentiality (High): Internal network resources, cloud metadata, and local services can be probed and their responses potentially exposed to the attacker through error messages or timing analysis.
• Integrity (High): In scenarios where SSRF targets internal writable endpoints, the attacker may be able to modify data or perform state-changing operations on internal services (e.g., configuration APIs).
• Availability (High): The DoS vector allows resource exhaustion attacks against the server processing the SVG.

Affected Systems: Applications using CairoSVG for SVG rendering, including:

• Web services with SVG-to-image conversion endpoints
• Content management systems with upload filters that accept SVG
• Document processing pipelines
• Data visualization platforms converting user-supplied SVG

Blast Radius: The SSRF impact extends beyond the processing server itself. Internal network infrastructure becomes accessible from the attacker's position. Cloud environments (AWS, GCP, Azure) are particularly at risk due to the accessible metadata endpoints at 169.254.169.254.

EPSS Context: The EPSS score of 0.00722 (50.5th percentile) indicates that exploit attempts are not yet widespread, but the 9.9 CVSS rating suggests that when public exploit code becomes available, adoption will be swift.

Detection Guidance

Sigma Rule

title: CairoSVG SSRF/DoS Exploitation Attempt via SVG External Resource
id: 5f8b3c9a-1d2e-4f6a-8b3c-9a1d2e4f6a8b
status: experimental
description: Detects suspicious SVG uploads or processing requests that reference external URLs
author: Valters IT Security Team
date: 2024/01/15
logsource:
    category: webserver
    product: nginx
    detection:
        selection_uri:
            cs-method: POST
            cs-uri-extension: .svg
        selection_payload:
            cs-body|contains|all:
                - 'http://'
                - '169.254'
                - '192.168'
                - '10.'
                - '172.'
                - 'localhost'
                - 'file://'
        selection_http:
            sc-status|startswith: '4'
        condition: selection_uri and selection_payload and selection_http
    falsepositives:
        - Legitimate SVG assets hosted externally
        - Admin uploading internal resources
    level: high
    tags:
        - attack.t1190
        - attack.t1048
        - cve.2023.27586

YARA Rule

rule CVE_2023_27586_CairoSVG_SSRF
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects SVG files with external resource references exploiting CairoSVG SSRF"
        date = "2024-01-15"
        cve = "CVE-2023-27586"
        severity = "critical"
    strings:
        $a = "http://" nocase
        $b = "https://" nocase
        $c = "file://" nocase
        $d = "169.254.169.254" nocase
        $e = "localhost" nocase
        $f = "192.168." nocase
        $g = "10." nocase
        $h = "172.16." nocase
        $i = "172.17." nocase
        $j = "172.18." nocase
        $k = "172.19." nocase
        $l = "172.2" nocase
        $m = "172.3" nocase
        $n = "<image" nocase
        $o = "<use" nocase
        $p = "xlink:href" nocase
        $q = "script" nocase
        $r = "BASE" nocase
        $cond1 = ($a or $b or $c) and ($d or $e or $f or $g or $h or $i or $j or $k or $l or $m)
        $cond2 = ($n or $o) and ($p)
        $cond3 = ($a or $b or $c) and $q
        $cond4 = ($a or $b or $c) and $r
    condition:
        uint32be(0) == 0x3C3F786D or uint32be(0) == 0x3C737667 or (filesize < 5MB and ($cond1 or $cond2 or $cond3 or $cond4))
    priority: critical
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-27586 CairoSVG SSRF Attempt via SVG Upload"; flow:established,to_server; content:"POST"; http_method; content:".svg"; http_uri; content:"http://"; http_client_body; pcre:"/(169\.254\.169\.254|localhost|192\.168\.|10\.[0-9]+\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/i"; classtype:attempted-admin; sid:202327586; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2023-27586; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-27586;)

Elastic Detection

// Detect SVG uploads with internal network references
sequence by host.name with maxspan=5m
  [network where process.name == "python*" and destination.ip == "169.254.169.254" or destination.ip == "127.0.0.1"]
  [file where event.action == "create" and file.extension == "svg"]

// Alternative query for web application logs
sequence with maxspan=30s
  [http where event.category == "web" and http.request.method == "POST" and http.request.body.content contains ".svg"]
  [http where event.category == "web" and http.response.status_code >= 400 and http.request.body.content matches ".*(169\\.254\\.169\\.254|localhost|192\\.168\\..*|10\\..*\\..*\\..*)"]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="*.svg"
| rex field=uri_path "(?<svg_name>[^/]+\.svg)$"
| search payload="*http://*" OR payload="*https://*" OR payload="*file://*"
| rex field=payload "(?<url_target>https?://[^\"'<>\\ ]+)"
| rex field=url_target "(?<target_host>([a-zA-Z0-9.-]+|([0-9]{1,3}\.){3}[0-9]{1,3}))"
| where target_host="169.254.169.254" OR target_host="localhost" OR target_host="127.0.0.1" OR match(target_host, "^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)")
| stats count by src_ip, target_host, svg_name, _time
| sort - _time

Wazuh OSSEC Rule

<group name="cairosvg,ssrf,cve_2023_27586,">
  <rule id="100275" level="12">
    <decoded_as>json</decoded_as>
    <match>POST</match>
    <match>\.svg</match>
    <regex>http://(169\.254\.169\.254|localhost|192\.168\.|10\.|172\.(16|17|18|19|2[0-9]|3[0-1])\.)</regex>
    <description>CairoSVG SSRF attempt detected (CVE-2023-27586): SVG upload with internal network reference</description>
    <group>attack.t1190,attack.t1048,</group>
    <mitre>
      <id>T1190</id>
      <id>T1048</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (Debian) claims patch, not independently confirmed.

1. Immediate Mitigations:

   • Upgrade CairoSVG to version 2.7.0 or later immediately. This version disables external file access by default, mitigating both SSRF and DoS vectors. Verify the installation source (pip, system package, or vendored copy) and update accordingly.
   • If immediate upgrade is not possible, implement a network-level block: use a firewall or egress proxy to prevent the processing server from reaching:
     • Cloud metadata endpoints (169.254.169.254)
     • Link-local addresses (169.254.0.0/16)
     • Loopback addresses (127.0.0.0/8)
     • Private RFC 1918 ranges (unless required by business)
     • Any internal network ranges not explicitly required for operation
   • If using environments that support it, configure network ACLs for containerized deployments to restrict egress from the SVG conversion service.

2. Patch/Upgrade Steps:

   • For pip installations: pip install --upgrade cairosvg
   • For Debian/Ubuntu: apt-get update && apt-get install --only-upgrade python3-cairosvg
   • For other distributions, check vendor repositories for backported patches.
   • Verify the patch by testing the installed version: python -c "import cairosvg; print(cairosvg.__version__)" — should return 2.7.0 or higher.
   • After patching, verify that legitimate external resource loading (if any) still functions by explicitly configuring the new opt-in setting.

3. Long-Term Hardening:

   • Implement an SVG sanitization layer that strips external resource references before processing. This can be done using SVG sanitization libraries or policy-based XML filtering.
   • Restrict SVG file uploads to trusted users only, or convert SVG to a raster format (PNG/JPEG) at the edge before processing.
   • Implement outbound network policies using egress firewalls to limit all server-to-server communication to approved destinations.
   • Add input validation on file upload endpoints to reject SVG files that reference external URLs.
   • Monitor egress traffic for anomalous outbound requests, particularly to internal IP ranges and metadata endpoints.
   • Subscribe to CVE updates for CairoSVG and related rasterization libraries to ensure rapid response to future vulnerabilities.
   • Conduct a security audit of any application that processes SVG files, including indirect usage through other libraries that depend on CairoSVG.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-27586
2. Debian Security Tracker (Patch Source): https://security-tracker.debian.org/tracker/CVE-2023-27586
3. CairoSVG Official Repository: https://github.com/Kozea/CairoSVG
4. CairoSVG Changelog (v2.7.0): https://github.com/Kozea/CairoSVG/blob/master/CHANGELOG.md (returned 404 — verify manually)
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Known Exploitation: As of this writing, CVE-2023-27586 is not listed in the CISA Known Exploited Vulnerabilities catalog, no public PoC or exploit code has been disclosed, and no Nuclei templates reference this CVE. The EPSS score of 0.00722 indicates low observed exploitation activity. However, the critical CVSS rating and ease of exploitation make this a high-priority candidate for future weaponization once public exploit details emerge.