If I have HTML page served over https with image loaded over http (image from other domain):

<img src="http://some-image.png"/>

so it's possible to inject any data to browser as image by using MITM attack. Is it possible to inject some Javascript code instead of image or maybe wrap some code to SVG image to execute this code in browser? Or the only risk is that someone can replace one image with another?


There're some exploits in old browsers, e.g. Opera10 allows to execute Javascript for SVG fonts in .svg files (https://html5sec.org/#43):

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg onload="alert(1)" xmlns="http://www.w3.org/2000/svg">
<defs><font id="x"><font-face font-family="y"/></font></defs>

Not the answer you're looking for? Browse other questions tagged or ask your own question.