6

Ok, here is a scenario for you here.

You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for the profile.

I have seen tricks in the past with XSS that use image tags to retrieve javascript code.

 <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">

Can this be done with a base64 encoded image? Is an attacker capable of crafting something that can introduce this sort of risk? If so, what can I do to mitigate the threat?

|improve this question
  • 1
    XSS isn't about the image, but about the javascript code (in your example). If an attacker can influence the code, he specifies the source of the image to be an image that he controls. – schroeder♦ Mar 17 '15 at 2:37
  • I know this. Can an attacker build an image that introduces the code (some sort of Polyglot)? – Meh Mar 17 '15 at 2:55
  • You typically use an image handler for this, and refer to the image by your own id. So something like src="imgs.mysite.com?id=123" where 123 is the id of the image in your database. Is this the scenario you mean to ask? – Andrew Hoffman Mar 17 '15 at 3:33
  • Or do you mean embedding base64 into the src? danielmclaren.com/2008/03/… – Andrew Hoffman Mar 17 '15 at 3:40
  • @Meh: You mean like <script src="//example.com/imagegenerator?with=datainterpretedascode">? – Bergi Mar 17 '15 at 11:52
13

Assuming you're handling the image data in a sensible manner, no. The data never gets put in a place where it could be seen as code.

Even if you're not handling the image data in a sensible manner, probably not. The base64 "alphabet" is missing some of the characters essential to producing useful Javascript -- there's only so much you can do with +, /, =, and the alphanumerics. Without parenthesis, brackets, semicolons, spaces, or quotation marks, you can't construct an SQL injection or a Javascript function call.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.