# XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net.

This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are not filtered in any way, so they may contain arbitrary HTML content (including script tags).

Would you consider this a security issue?

On the one hand, it allows one to run code if someone accesses the image (say, by clicking on it in the context of example.com). On the other, it only runs under the CDN’s domain so you can’t steal cookies and such. It could be used to redirect to a malicious site though.

Another note: The image is served with Content-Security-Policy:default-src 'none'; so the code runs only under IE.

Yes, this is a major security vulnerability, but that has nothing to do with XSS.

For example, an attacker might render a fake log-in form and trick your users into handing out their passwords.

The SVG can also be used for a clickjacking attack against yourself or sites which trust you, even if state-of-the-art protection is in action. Standard techniques like the The X-Frame-Options header usually just check the top-level browsing context, and that is your site. So an attacker is likely to be able to embed other pages of your own site or partner sites in a frame and then trick the user into taking actions on those pages.

In general it is always a risk when you include content from a not absolutely trusted source that is not fully under your own control. So it makes sense to be very restrictive with it. Maybe you can change the workflow in a way that you are in control of what images are uploaded to the CDN this would help to reduce the risks significantly.

While I'm not an expert on the details of the browser side implementation of CSP, if you white list only:

img-src for the CDN - the browser would in general only allow rendering images from that source and would prohibit execution of any scripts or loading of other content type (violated directive) from that source.

I'm quite sure that this also works if the script code is disguised as an image as the browser will just accept only image content from that source (the CSP concept would be quite useless if that would be possible). The protection of course only works if the content is displayed in the context of the site that has CSP implemented. If you load that image URL directly in the browser CSP can not protect you.

To be absolutely certain I would recommend you to verify it explicitly.

This is certainly a security risk. If you're not sanitizing HTMl code, this leaves you open to both easy XSS, and browser hooking if and image containing malicious HTML is clicked. If this image is saved on the server, this makes the site vulnerable to persistent XSS. One could convert the image to hex, and also include HTML even to bypass a filter, and run JavaScript code, ect.