An inline SVG in HTML can contain event handlers and SVG script nodes. So if I can specify an SVG image for your page to load, and get you to inline it in the page, then I can inject script via that image.
The HTML5 spec
svg element from the SVG namespace falls into the embedded content, phrasing content, and flow content categories for the purposes of the content models in this specification.
The semantics of SVG elements are defined by the SVG specification and other applicable specifications. [SVG]
Mario Heiderich exploited confusion in Opera about which domain SVG content should run in to create an image that when loaded cross-domain attacks various layers and ends up calling his phone.
- SVGs are not just images but mini-applications
- tags can now deploy Java, PDF and Flash – and call you
- In-line SVG creates small XML islands enabling XML attacks on
- SVG and XSLT work too, enabling DoS and other attacks
- Web-security and XML security, they meet again!
- And XXE is back – remember 2002's advisories?
- SVG is not getting enough attention in the security
- SVG provides a lot of room for more security research
In earlier slides, Mario discusses XSS specifically and problems with download of SVG files for running locally and notes
- Allowing SVG for upload == allowing HTML for upload
Browsers perform content-sniffing ostensibly in the interest of usability so even badly configured servers can continue to “work”. The problem here is that a browser gives different types of content different amounts of access. If you can fool the browser into thinking one type of content is actually another you can bypass the restrictions placed on the actual content’s access. For example, an HTML page is allowed to load external images, stylesheets and scripts. In this case the security context these resources execute in is derived from the URL of the page that these resources are embedded in. On the other hand, if the type of content being loaded is Flash or Java applet say, the security context is derived from the URL of the applet object itself. If the browser uses heuristics and gets confused between a Flash object and an image, there are real security implications! It was this type of confusion which was the source of the GIFAR attack.