-1

I'm working on a svg image generator. Now I want to set the user width and height value.

Can a user exploit this element tags? And what should I do to make this secure?

<?php
    $user_input = $_GET["name"];
?>

<svg width="<?php echo $user_input;?>" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>
3
  • xml is a config file, what really matters is how the function that consumes the settings handles the data
    – schroeder
    May 18, 2016 at 15:46
  • Is it really width="$UserInput" in the inner text or is it an attribute? Anyways, without sanatization, we can ofcourse manipulate it. Set $userinput equal to 12" </svg> <script> alert('XSS'); </script> <svg> width="12 May 18, 2016 at 15:47
  • The XML with the svg is directly showed to the user and rendered by the browser.
    – Peter234
    May 18, 2016 at 15:48

1 Answer 1

0

Yes, your SVG can easily be altered to execute arbitrary code. You have a reflected XSS vulnerability right there.

When you have

<svg width="<?php echo $_GET["name"];?>" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

Set name be equal to 40"> <script> alert('XSS'); </script></svg> <svg width="100. The resulting XML will now be

<svg width="40"> <script> alert('XSS'); </script> </svg><svg width="100" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

And thus, we have injected a <script> tag and can execute arbitrary code on the client side.

SVG is no "dead image", it's alive. You can have script tags in there, even "g" objects have "onload" handlers. There is a whole bunch of attacks that can be carried out when you control an SVG that the user shows.

Also read "The Image that called me back" for more info. There are lots of more attack vectors described there.

So, to make your application safe, you must ensure that you cannot break out of the quotes.

2
  • An SVG in an img tag do not permit JavaScript in any recent browser I tested. An SVG in an iframe, object, or through direct access does though. May 18, 2016 at 16:10
  • That's true and also stated in the presentation I linked. If however it's embeded into an <iframe> or <embed> or <object> structure (or inlined directly), the above payload will fire. As per sé, it's important to stress here that input sanatization should not be left out just because they're writing into an SVG. Every quote should be escaped to prevent breaking out from it. May 18, 2016 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .