Microsoft’s Bing Images service contained a pair of critical vulnerabilities that allowed attackers to achieve remote code execution at the SYSTEM level on the company’s servers simply by uploading a malicious SVG file.
Security researcher Orange Tsai disclosed the flaws, which resided in Bing Images’ SVG processing pipeline. The first bug involved a path traversal issue in the service’s image conversion library, letting attackers write files to arbitrary locations on the server. The second was an XML external entity (XXE) injection vulnerability that expanded the attack surface significantly.
By chaining these two issues together, an attacker could craft an SVG that, when processed by Bing’s backend infrastructure, would execute arbitrary commands with SYSTEM privileges. The attack required no authentication — any user capable of uploading an image to Bing Images could trigger the exploit chain.
Microsoft patched both vulnerabilities following responsible disclosure. The company credited the researcher with identifying weaknesses in how the service sanitized uploaded content before server-side processing. The case underscores the risk that image-processing pipelines pose when they parse complex file formats like SVG, which supports embedded scripts and external entity references.
Organizations running similar image-processing infrastructure should audit their SVG handling routines and ensure proper sandboxing of parsing libraries.
