I am currently doing a bug bounty program and was testing the company's file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded file to '.svg' using burpsuite. I have read tons of article saying that .svg files is equal to XSS. In my case I was not able to fully upload svg file since the server is checking the content of the file. I have change the 'Content-Type' to image/svg and the file is uploaded, but when I change the content of the file with XML Tags, the server denied my upload. I found out that in order for the file to be uploaded successful, the beginning of the content type should be '...JFIF' which is a metadata to describe that the content is JPEG/PNG and is interchangable. I have tried appending the SVG XML tag after the metadata and has successfully uploaded it to the server, but when the image is opened, a square image appeared and my XML tags are not being executed.

Is there any way I could bypass this image content to be able to execute XML? Is there any metada for SVG perhaps?

The broken image

this image can be accessed from https://[redacted]/avt/131231/original/filename.svg

  • I couldn't write the first part of the metadata but it is = 'ÿØÿà' Commented Aug 8, 2020 at 15:01
  • 4
    "I have read tons of article saying that .svg files is equal to XSS" that's nonsense. You need to understand what you're reading and doing. Commented Aug 8, 2020 at 16:00
  • 1
    There are too few details to determine how the site you test behaves in detail and how exactly you are testing. In any case: script inside the svg will not be executed if the svg is embedded with img tag. Commented Aug 8, 2020 at 16:45
  • @MarcusMüller, What I read is that since .svg files are made up of XML tags, therefore it is possible, in most scenarios, to have a script tag and therefore have stored XSS. Commented Aug 8, 2020 at 18:24
  • 3
    I don't think that screenshot is really adding very much, but I also don't think there is a vulnerability here. As has been pointed out, an SVG != XSS. In this case in particular the fact that the upload is only possible with the JFIF metadata means that they are properly enforcing a JPG image type. When you add that to the top of your SVG you no longer have an SVG - you have a corrupt JPG with a .svg extension. That wouldn't give you XSS even if you an SVG did mean XSS (which it usually doesn't). Remember that it isn't the extension that determines the type of file, but the contents. Commented Aug 8, 2020 at 19:08


Browse other questions tagged .