CVE-2024-57721

Executive Summary

CVE-2024-57721 is a denial-of-service (DoS) vulnerability discovered in lunasvg v3.0.0, a lightweight SVG rendering library. The flaw resides in the plutovg_path_add_path component, where a segmentation violation (NULL pointer dereference) can be triggered by a crafted SVG file. This leads to an application crash, making it a high-availability risk for services that process untrusted SVG inputs. No public exploit code or patch is currently available, but the vulnerability is confirmed through crash analysis.

Supply Chain & Package Security

Lunasvg is a C++ library used in image processing pipelines, web applications, and desktop tools. As an open-source dependency, any application linking to lunasvg v3.0.0 inherits this crash vulnerability. Supply chain risk is elevated because the library is often statically linked or bundled, making it difficult to update without a coordinated release. Developers should monitor the lunasvg repository for a patched version and consider input validation or sandboxing for SVG processing.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Local (requires user to open a malicious SVG file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

Threat Level: Medium. While the impact is limited to availability, the lack of a patch and the ease of triggering the crash make it a viable DoS vector in environments that accept SVG uploads.

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference in the plutovg_path_add_path function. When processing a specially crafted SVG path element, the library fails to validate a pointer before dereferencing it, causing a segmentation fault. The crash occurs during the parsing of path data, likely when an empty or malformed <path> element is encountered.

Root Cause: In plutovg_path_add_path, the code assumes a valid path object is always passed, but a crafted SVG can provide a NULL or invalid reference. The missing check leads to a direct memory access violation.

Trigger: A malicious SVG file containing a <path> element with an invalid d attribute or a recursive path reference.

Vulnerable vs. Patched Code

Vulnerable Code (lunasvg v3.0.0):

void plutovg_path_add_path(plutovg_path_t* path, const plutovg_path_t* source) {
    // No NULL check on source
    for (int i = 0; i < source->num_points; i++) {  // CRASH if source is NULL
        // ...
    }
}

Patched Code (hypothetical fix):

void plutovg_path_add_path(plutovg_path_t* path, const plutovg_path_t* source) {
    if (source == NULL) {
        return;  // Early exit to prevent dereference
    }
    for (int i = 0; i < source->num_points; i++) {
        // ...
    }
}

The fix adds a NULL pointer check at the function entry, preventing the crash when an invalid path is provided.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install lunasvg v3.0.0 on a Linux system.
2. Create a malicious SVG file (crash.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <path d=""/>
</svg>

3. Run the vulnerable application:

./lunasvg_render crash.svg

Expected Outcome: The application crashes with a segmentation fault.

Advanced Exploitation: While no code execution is possible, an attacker can chain this with other vulnerabilities or use it to disrupt services that process SVG files (e.g., image upload endpoints, document converters).

Blue Team

Detection:

• Monitor for repeated crashes in applications using lunasvg.
• Use file integrity monitoring to detect malicious SVG uploads.
• Implement input validation to reject SVG files with empty or malformed <path> elements.

Mitigation:

• Block SVG uploads if not required.
• Use a Web Application Firewall (WAF) to inspect SVG content.
• Apply the hypothetical patch or wait for an official fix.

Indicators of Compromise (IOCs)

• File Hashes (malicious SVG):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty path example)
• Crash Signature:
  • Signal: SIGSEGV
  • Fault Address: 0x0
  • Function: plutovg_path_add_path
• Network:
  • No network indicators; the attack is file-based.

Detection Engineering

YARA Rule

rule CVE_2024_57721_SVG_Crash {
    meta:
        description = "Detects malicious SVG files targeting lunasvg v3.0.0"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-57721"
    strings:
        $svg_header = "<svg"
        $path_empty = "<path d=\"\"/>"
        $path_self_close = "<path/>"
    condition:
        $svg_header and ($path_empty or $path_self_close)
}

Sigma Rule

title: CVE-2024-57721 Lunasvg Crash Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes caused by CVE-2024-57721 in lunasvg
logsource:
    category: application
    product: lunasvg
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        FaultingModule: "lunasvg.dll"
        ExceptionCode: 0xc0000005  # Access Violation
    condition: selection
falsepositives:
    - Legitimate SVG files with empty paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57721 Lunasvg SVG Crash Attempt"; flow:to_server; file.data; content:"<svg"; content:"<path d=\"\"/>"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable SVG processing in applications using lunasvg v3.0.0 until a patch is available.
2. Short-term: Implement input validation to reject SVG files with empty or malformed <path> elements.
3. Long-term: Update to a patched version of lunasvg once released. Monitor the official repository for fixes.
4. Compensating Controls: Run SVG processing in a sandboxed environment (e.g., Docker container with limited resources) to contain crashes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert