-1

I'm working on a svg image generator. Now I want to set the user width and height value.

Can a user exploit this element tags? And what should I do to make this secure?

<?php
    $user_input = $_GET["name"];
?>

<svg width="<?php echo $user_input;?>" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>
  • xml is a config file, what really matters is how the function that consumes the settings handles the data – schroeder May 18 '16 at 15:46
  • Is it really width="$UserInput" in the inner text or is it an attribute? Anyways, without sanatization, we can ofcourse manipulate it. Set $userinput equal to 12" </svg> <script> alert('XSS'); </script> <svg> width="12 – Maximilian Gerhardt May 18 '16 at 15:47
  • The XML with the svg is directly showed to the user and rendered by the browser. – Peter234 May 18 '16 at 15:48
0

Yes, your SVG can easily be altered to execute arbitrary code. You have a reflected XSS vulnerability right there.

When you have

<svg width="<?php echo $_GET["name"];?>" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

Set name be equal to 40"> <script> alert('XSS'); </script></svg> <svg width="100. The resulting XML will now be

<svg width="40"> <script> alert('XSS'); </script> </svg><svg width="100" height="100">
    <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

And thus, we have injected a <script> tag and can execute arbitrary code on the client side.

SVG is no "dead image", it's alive. You can have script tags in there, even "g" objects have "onload" handlers. There is a whole bunch of attacks that can be carried out when you control an SVG that the user shows.

Also read "The Image that called me back" for more info. There are lots of more attack vectors described there.

So, to make your application safe, you must ensure that you cannot break out of the quotes.

  • An SVG in an img tag do not permit JavaScript in any recent browser I tested. An SVG in an iframe, object, or through direct access does though. – Alexander O'Mara May 18 '16 at 16:10
  • That's true and also stated in the presentation I linked. If however it's embeded into an <iframe> or <embed> or <object> structure (or inlined directly), the above payload will fire. As per sé, it's important to stress here that input sanatization should not be left out just because they're writing into an SVG. Every quote should be escaped to prevent breaking out from it. – Maximilian Gerhardt May 18 '16 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.