SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE

Summary

In this report, the researcher found that by submitting crafted SVG files, he was able to establish a listener on our server that enabled SSRF attacks. This potentially could have been pivoted to carry out more damaging attacks as well. We improved our validation of user-submitted SVG files to prevent this from happening in the future.

I found that Imagemagick would happily send the users' login and NTLMv2 hash to remote attackers when processing UNC paths. This could be leveraged to crack the server password offline or potentially in an SMB relay attack.

Thanks to Dirk Lemstra for fixing this in Imagemagick too! https://github.com/ImageMagick/librsvg/commit/f9d69eadd2b16b00d1a1f9f286122123f8e547dd