SSRF (Server-Side Request Forgery) is possible [CVE-2017-5617]

[luc-lynx]

If the library is being used in a web application for processing user supplied SVG files then the app is vulnerable to SSRF.

The attacker can send a specially crafted svg file, for example

<svg width="5cm" height="4cm" version="1.1"
     xmlns="http://www.w3.org/2000/svg" xmlns:xlink= "http://www.w3.org/1999/xlink">
	<image xlink:href="https://host-in-the-trusted-network.com/test.jpg" x="0" y="0" height="50px" width="50px"/>
</svg>

and the lib will send the request inside the trusted network to the host-in-the-trusted-network.com (bypassing the firewall). In general, the attacker can use any scheme supported by default (such as file://, jar:// etc) or use application specific scheme.

How to fix - any schemes apart from data in the xlink:href attribute should be disallowed by default at https://github.com/blackears/svgSalamander/blob/master/svg-core/src/main/java/com/kitfox/svg/ImageSVG.java#L120

Additional information:
https://cwe.mitre.org/data/definitions/918.html
http://www.slideshare.net/d0znpp/ssrf-attacks-and-sockets-smorgasbord-of-vulnerabilities

[carnil]

A CVE was requested on oss-security.

[luc-lynx]

CVE-2017-5617 is assigned for the issue
http://www.openwall.com/lists/oss-security/2017/01/29/2

[don-vip]

Fixed in JOSM embedded fork: https://josm.openstreetmap.de/changeset/11526/josm

[sebastic]

@don-vip, will you also provide a PR with the changes from JOSM?

Otherwise I'll create a PR with your changes for inclusion in this repository.

[don-vip]

Done: #12

[luc-lynx]

@don-vip great! thanks!

[blackears]

I'm replacing the work done here with a flag that you can set in SVG Universe. The implementation that was done for #12 simply deletes the old functionality.

[don-vip]

Commit for reference: a0cdd69

[don-vip]

The fix is incomplete. We added in JOSM a non-regression test to make sure we're never vulnerable, and the test fails now that I updated to 1.1.2 without the patch we added in our fork. I'm going to submit a new PR that fixes the problem for good.