1

If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (SOP) being in place or would SOP prevent it?

Improve this question

1 Answer 1

Reset to default
0

If mainprod.com is loading the image from cdn.example.com via <embed>, like this:

<embed src="https://cdn.example.com/whatever.svg" width="300" height="200">

then, the JavaScript code within the SVG will actually execute, but in the security context of cdn.example.com. Therefore, no attack is possible here. The script will not be able to access the contents/cookies of mainprod.com due to same-origin policy.

If mainprod.com is loading the image from cdn.example.com via <img>, like this:

<img src="https://cdn.example.com/whatever.svg" width="300" height="200">

then, no JavaScript code within the SVG will execute at all. All the JavaScript code within the SVG will be ignored by the browser and only the image will be rendered. Same origin policy will not play any role here, as there is no JavaScript executing at all.

So in the above scenarios, no attack is possible. The only possible attack scenario which could lead to XSS is if mainprod.com fetches the contents from https://cdn.example.com/whatever.svg server-side and writes the response directly into the mainprod.com HTML document. However, this scenario is highly unlikely.

Improve this answer
8
  • To test this I used this code on site a and on site B I used this svg XSS payload. Now what I am seeing is when I visit site A there are no XSS pop-up's however, when from site A I right click on the image and open it in new tab the cookies from site A are displayed in site B when the XSS is triggered. Is it supposed to happen?
    – anonmer
    Commented Dec 17, 2023 at 2:11
  • 1
    Hey @mateleco, I'm curious about my situation. Is there any possibility of exceptions to this rule? I had a scenario where I hosted an HTML file and another SVG file with to XSS payload on the same IP address, but with different ports. Specifically, site A, which contained the HTML fetching an SVG from site B, was hosted on 192.168.1.1:8080, while site B, where the SVG was located, was hosted on 192.168.1.1:8000.
    – anonmer
    Commented Dec 17, 2023 at 4:50
  • I guess it's because SOP only works on domains and not IP addresses directly.
    – anonmer
    Commented Dec 17, 2023 at 5:11
  • No, it's not because domain vs IP address. It's because cookies don't follow same origin rules. Cookies are shared across ports. See here: are cookies port-specific?
    – mateleco
    Commented Dec 17, 2023 at 5:37
  • Cookies can also be shared across subdomains. See more here. Basically, if you are in example.com and execute document.cookie="test=123;domain=example.com;path=/" you will be able to see this cookie from all subdomains of example.com (e.g. asd.example.com, foo.example.com etc.) and even sub-sub-domains (foo.bar.example.com).
    – mateleco
    Commented Dec 17, 2023 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .