2

I wrote a JQuery tool to preview images before uploads.

  • User A clicks the explore button to select an image
  • selects it
  • a change-event displays the image

If user A selects a prepared SVG image as "greetings_ILL_xss_your_site.svg" or "greetings_ILL_xss_your_site.gif" my JQuery will get the image from tmp dir, resize and display it.

As svg are small programs, and gif can contain scripts:

  • Could it run code that uses XSS scripts?
  • Is the previewed image authenticated to run script requests?
Improve this question
12
  • But the images are local to the user's machine ...
    – schroeder ♦
    Jun 22, 2018 at 14:22
  • @schroeder might still be possible to use his site to do a reflected XSS
    – Mike Ounsworth
    Jun 22, 2018 at 14:24
  • @MikeOunsworth the tool that selects local image files?
    – schroeder ♦
    Jun 22, 2018 at 14:25
  • 1
    So what's the question you're trying to ask?
    – Mike Ounsworth
    Jun 22, 2018 at 14:32
  • 1
    @quevedo safe from what and safe for whom?
    – schroeder ♦
    Jun 22, 2018 at 14:34

2 Answers 2

Reset to default
1

No, there's not. If someone wants to attack one's own machine with JS, devtool's console tab is much easier than crafting a bad svg. XSS is only a problem when malicious code is shared with other users. If the user was unaware the file was malicious, it could present a problem, but it's not yours to deal with.

Furthermore, the origin/protocol context in which a preview image would be displayed (data: or blob:) should protect your site from being reached by a bad image's code anyway (though some zero-days or whatever could be possible).

Improve this answer
4
  • 1
    What makes you think that the user made the SVG file himself? Someone could share malicious SVG file online.
    – FINDarkside
    Jun 22, 2018 at 22:06
  • As svg file is executed while rezising, I think It should post the page (xss) to get sensible info
    – quevedo
    Jun 22, 2018 at 22:54
  • Just now I'm about to test a file using 2 virtual machines, I hope I'l see if i can post the page form the image scripts to other server from a previewed image
    – quevedo
    Jun 22, 2018 at 22:57
  • 1
    if you display it via an <img> tag, svg script/dom is sandboxed from the page. If you display it via an <iframe>, the SOP should still protect you because of the protocol mismatch.
    – dandavis
    Jun 23, 2018 at 17:51
-1

Yes, Self-XSS can be possible. The user would have to create the exploitable svg/gif by himself or download a compromised one from somewhere.

And if the image's filename is NOT re-encoded and stripped of its EXIF tags/properties, the image created in the tmp directory can be used as a link for Reflected XSS, which is triggered when a victim clicks on the vulnerable link.

As for whether the previewed image is authenticated to run script requests, that depends on how it is read on the page it is being displayed. If it is loaded directly without any CSP protection or re-encoded as I have mentioned above, then it would be possible to run script requests.

Improve this answer
2
  • Using an image in a temp directory for reflected XSS is often impossible. It depends on how the images are stored (temporary images may not be stored in a public directory) and the image format. The OP mentioned gifs and svgs. Gifs can't be used for reflected XSS, and while svg can be used for some servers (it depends on the headers returned by the server) it still requires the attacker to get the end user to click a link, making it a much harder XSS attack than most.
    – Conor Mancone
    Aug 17, 2019 at 12:27
  • @ConorMancone Gif is just an extension. The filename is still an attack vector.
    – isopach
    Aug 21, 2019 at 6:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .