replaced http://security.stackexchange.com/ with https://security.stackexchange.com/

Source Link

edited Mar 17, 2017 at 13:14

1

Some answers mention that it's possible possible to inject inject attacker-controlled HTML into images and therefore provoke XSS.

I guess that this HTML will be processed by browser only if hole exists in browser. So I think it's more a browser issue and there is no need to convert those images, strip EXIF metadata, randomize them at web-application's side.

Is attacker able to inject HTML into image that will provoke XSS? If yes, how?

Tweeted twitter.com/#!/StackSecurity/status/201269308209364993

occurred May 12, 2012 at 11:15

better title

Link

edited May 12, 2012 at 7:17

Andrei Botalov

5.5k
11
50
74

Is it really possible to exploitinject HTML into image to provoke XSS in attacker-controlled images?

Source Link

asked May 11, 2012 at 18:50

Andrei Botalov

5.5k
11
50
74

Is it really possible to exploit XSS in attacker-controlled images?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.

I guess that this HTML will be processed by browser only if hole exists in browser. So I think it's more a browser issue and there is no need to convert those images, strip EXIF metadata, randomize them at web-application's side.

Is attacker able to inject HTML into image that will provoke XSS? If yes, how?

Stack Exchange Network

Return to Question

Is it really possible to exploitinject HTML into image to provoke XSS in attacker-controlled images?

Is it really possible to exploit XSS in attacker-controlled images?