Skip to main content
Information Security

Return to Question

added 8 characters in body
Source Link
anonmer
anonmer
  • 13
  • 3

If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (SOP) being in place or would SOP prevent it?

If an SVG file with an XSS payload is hosted on cdn.example.com and is loaded as a display picture on mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (SOP) being in place or would SOP prevent it?

If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (SOP) being in place or would SOP prevent it?

Source Link
anonmer
anonmer
  • 13
  • 3

SOP (Same Origin Policy) and CDN SVG XSS

If an SVG file with an XSS payload is hosted on cdn.example.com and is loaded as a display picture on mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (SOP) being in place or would SOP prevent it?