[Bimi] Verified Mark Certificates with SVGs not compliant with the Tiny PS profile

[Hanno Böck <[e-mail]>]

Hi,

I discovered that SVG logos embedded in many Verified Mark Certificates
were not compliant with the VMC Requirements.

A security feature of BIMI and VMCs is that the SVG logos should be
validated with the SVG Tiny PS (Portable/Secure) [1] profile, a subset
of SVG provided as a Relax NG schema. This seems like a reasonable
idea, as SVG images come with a range of possible security risks (XML
security risks, XSS).

However, it does not appear that this is taken very seriously within
the BIMI ecosystem. I discovered over 200 VMCs, issued over a time span
of more than four years, with logos not compliant with the SVG Tiny PS
profile. Furthermore, it does not appear that the largest e-mail
provider implementing BIMI - Gmail - validates SVG images according to
the specification.

Between 2019 and today, Entrust has issued 223 certificates with
non-compliant SVGs, more than half of them not yet expired. Digicert
has issued two certificates with non-compliant SVGs and two more with
an invalid data url.

These non-compliant SVGs were likely mistakes and not part of an
attack. There are recommendations by BIMIGroup and Gmail to manually
edit SVG files created by Adobe Illustrator to comply with this
profile. Unsurprisingly, this is not very reliable.

You can find a quick and dirty script to validate SVGs in VMCs here
[3]. You can also find a full list of affected certificates via their
crt.sh IDs there in the subdirectory testdata.

I reported the issue to Entrust's problem-reporting mail addresses on
2024-05-17. I received an irritating autoreply indicating that this
mail address was only meant for existing Entrust customers. ("We are
unable to associate your email address with an active account or order
number and are unable to determine your support contract.") However,
Entrust later confirmed that this is their correct problem reporting
address, and the issue was addressed.

I had "accidentally" not reported all unexpired certs with invalid SVGs
that I had found and added a few certs with valid SVG files. (I may
have done that to test whether Entrust would notice it.)

To their credit, Entrust did not revoke the certificates with valid
SVGs and they revoked all the certificates with invalid SVGs, including
those I had not reported. Entrust revoked all affected certificates as
of 2024-05-23. This is slightly longer than the 5 days that the VMC
requirements demand[2].

The affected Digicert certificates were all expired. Therefore, I have
not reported them.

I also noticed that certificates with those not validating SVGs would
still be displayed within Gmail. I reported this to Gmail, but they
appear to have decided that it is not an issue deserving their
attention. ("We've decided that the issue you reported is not severe
enough for us to track it as a security bug.")

I was surprised by this reaction. I would expect security-conscious
implementors of BIMI to validate SVGs against the security profile.
While I assume Gmail has additional security measures like sandboxing
their SVG renderer, there is an important indirect effect that such a
validation would have: it is very likely that this issue would have
been detected much sooner if the invalid logos had not been displayed
in Gmail.

Ultimately, the most noteworthy part of this issue is that it stayed
undetected for so long. Over a timeframe of more than four years,
Entrust has issued over 200 certificates with SVG files not validating
against the security profile. Entrust did not notice it, and neither
did anyone else. It does not appear anyone is monitoring the VMC/BIMI
ecosystem for compliance with the specs and security requirements.


[1] https://bimigroup.org/resources/SVG_PS-latest.rnc.txt
[2] https://bimigroup.org/resources/VMC_Requirements_latest.pdf
[3] https://github.com/hannob/vmcval

-- 
Hanno Böck - Independent security researcher
https://itsec.hboeck.de/