CVE-2022-44729

What it actually does

Malicious SVG input processed by Batik 1.16 triggers default loading of external resources, enabling SSRF that can lead to outbound network requests for resource consumption or limited information disclosure.

Why it matters to the business

Applications handling untrusted SVG files risk unexpected network activity, potential denial of service from resource exhaustion, or leakage of internal network details, increasing operational overhead and compliance exposure in document-processing workflows.

How an attack unfolds

An attacker supplies a crafted SVG containing external entity references or image links; when Batik 1.16 parses the SVG, it resolves the external references by default, issuing outbound requests that may reach internal services or the internet.

How to fix it

Upgrade Apache XML Graphics Batik to version 1.17 or later; where immediate upgrade is not feasible, disable external resource loading through configuration or input sanitization before SVG processing.

How to confirm the fix worked

Confirm Batik version is 1.17 or higher in dependency manifests or build files; test with a sample malicious SVG containing external references and verify that no outbound requests are issued.

Typical attack path

1. Identify an application or service that accepts or renders SVG files using Batik 1.16
2. Craft an SVG with external resource references or entity declarations pointing to attacker-controlled or internal targets
3. Submit the SVG for processing via file upload, document import, or rendering pipeline
4. Observe resulting outbound connections for resource consumption or data exfiltration

How to detect it

Monitor application logs and network traffic for unexpected outbound HTTP or other protocol connections originating from SVG processing components; review file upload or rendering audit trails for SVG content containing external entity or image references.

What your security team should do

• Prioritize upgrade of Batik to 1.17+ in all build and deployment pipelines within the next sprint
• Inventory all applications that process SVG content and flag those still on 1.16 for immediate patching
• Implement network egress controls around SVG-processing services as a temporary compensating control
• Add automated dependency scanning to prevent reintroduction of vulnerable Batik versions