Compliance Impact

This vulnerability allows an attacker to craft malicious Vega diagram specifications that can send requests to any URL, including local file system paths, potentially exposing sensitive information. Such unauthorized exposure of sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive information. The fix implemented prevents loading external data URLs in secure mode, thereby mitigating the risk of unauthorized data access and helping maintain compliance with these standards. [1]

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs due to insufficient sanitization in Vega's convert() function when safeMode is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that includes external URLs, allowing them to send requests to any URL, including local file system paths. This can lead to exposure of sensitive information by loading untrusted or sensitive external resources. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to exploit the Vega convert() function to send requests to arbitrary URLs, including local file system paths. This can result in unauthorized exposure of sensitive information from your system or network, potentially leading to data breaches or information leakage. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if Vega specifications processed by Kroki in secure mode contain any external data URLs in the `data.url` attribute or within nested structures such as `marks[].data[].url`. If such URLs are present, the `convert()` function will throw an `UnsafeIncludeError`. To detect this on your system, you can review Vega specification files or logs for errors mentioning `UnsafeIncludeError`. Additionally, monitoring network traffic for unexpected outgoing requests to external URLs from Vega processing components may help identify exploitation attempts. There are no specific commands provided, but inspecting Vega specs for `data.url` fields or searching logs for `UnsafeIncludeError` messages is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, ensure that Kroki is running in secure mode (safeMode set to 'secure'), which prevents loading external data URLs in Vega specifications. Avoid using Vega specifications that include external `data.url` attributes; instead, provide data inline via the `values` attribute. If external URLs are necessary, run Kroki in unsafe mode by setting the `KROKI_SAFE_MODE` environment variable accordingly, but be aware this reduces security. Applying the patch from the referenced fix (commit f31093cd8a0a1d6999c43d560f62d1e82d59c77e) is also essential to enforce these checks. [1]

Useful 0 Not Useful 0