Regular Expression Denial of Service in CairoSVG
Summary
Regular Expression Denial of Service in CairoSVG
Original description
The description as published by the source.
Doyensec Vulnerability Advisory
- Regular Expression Denial of Service (REDoS) in cairosvg
- Affected Product: CairoSVG v2.0.0+
- Vendor: https://github.com/Kozea
- Severity: Medium
- Vulnerability Class: Denial of Service
- Author(s): Ben Caller (Doyensec)
Summary
When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).
If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.
Technical description
The vulnerable regular expressions are
The section between 'rgb(' and the final ')' contains multiple overlapping groups.
Since all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.
The complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.
Reproduction steps
Create a malicious SVG of the form:
with the following code:
''
Note that there is no closing parenthesis before the semi-colon.
Run cairosvg e.g.:
cairosvg cairo-redos.svg -o x.png
and notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.
Remediation
Fix the regexes to…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-21236 cairosvg Fixed in: 2.5.0-1.1
- Ubuntu UBUNTU-CVE-2021-21236 cairosvg
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web pypi.org