Questions tagged [svg]

An XML-based vector image format for two-dimensional graphics with support for interactivity and animation.

0
votes
0answers
56 views

How to exploit SVG xlink-based SSRF

First, let me summarize how the SSRF works: 1) You setup an SVG image with a reference to your server via xlink. Here's an example that works: <?xml version="1.0" encoding="UTF-8" standalone="no"?...
1
vote
1answer
56 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
2
votes
1answer
51 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
8
votes
2answers
550 views

Restrict JS in SVGs

Does anyone know of a way to prevent JS from running inside of an SVG or stripping out JS from an SVG? In my use case I'd prefer to keep the image as an SVG and not convert it to a JPG. I've thought ...
2
votes
1answer
117 views

Could an SE question that runs an SVG from a private website potentially be dangerous?

This SE question (now deleted, so not easily viewed) contains an animated SVG that loads from a private website instead of the usual GIF's hosted by imgur. The line is: ![https://www.moonwards.com/...
9
votes
1answer
722 views

SVG files and billion laughs attack

SVG files are susceptible to billion laughs attack. Our website allows users to upload/submit markdown files and we run the .md file through marked.js before rendering it. Now images in the markdown ...
0
votes
1answer
253 views

SVG virus/ malware with an extension on Google Chrome (one) [closed]

This question is about the SVG virus malware I got through Facebook, which adds a malicious Google Chrome extension. It's called one or ubo. Some articles write that it is ransomware. I think I ...
7
votes
1answer
1k views

Preventing XSS in SVG

Currently assessing an application, I found out that it is possible to submit an SVG fill containing Javascript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
-1
votes
1answer
1k views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = $...
3
votes
1answer
2k views

Can an XXE (XML External Entity) attack be carried out from within an SVG file?

Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
2
votes
1answer
128 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
1
vote
3answers
557 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
4
votes
2answers
227 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <...
0
votes
2answers
206 views

SVG-Snippets in Access-Log: Probe or Error?

I get some hits every then and there from different IPs, always the same scheme: GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 (...
16
votes
2answers
4k views

Why does this XSS vector work in svg but not in HTML?

Why does this vector : <svg><script>alert&#40/1/.source&#41</script> works in http://jsfiddle.net/ZgPY4/2/ and this one <script>alert&#40/1/.source&#41</...