Say there is a website example.com
. It hosts static content from a CDN, example.net
.
This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are not filtered in any way, so they may contain arbitrary HTML content (including script tags).
Would you consider this a security issue?
On the one hand, it allows one to run code if someone accesses the image (say, by clicking on it in the context of example.com
). On the other, it only runs under the CDN’s domain so you can’t steal cookies and such. It could be used to redirect to a malicious site though.
Another note: The image is served with Content-Security-Policy:default-src 'none';
so the code runs only under IE.