Questions tagged [svg]
An XML-based vector image format for two-dimensional graphics with support for interactivity and animation.
22
questions
2
votes
1
answer
125
views
SVG XSS - When script tag and on* attributes are filtered
I'm looking at an XSS lab that has the tags: script, iframe, object and embed filtered, and all on* attributes are filtered. However, svg is allowed.
Is this exploitable, with no user interaction ...
- 34.6k
1
vote
1
answer
181
views
SOP (Same Origin Policy) and CDN SVG XSS
If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from ...
- 13
3
votes
2
answers
1k
views
Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?
My understanding is that:
SVGs offer far greater functionality if they are directly embedded in a site's HTML code via the <svg> tag than if they are linked to via the <img> tag
For ...
- 6,167
2
votes
1
answer
349
views
What sandbox does an <object> element run in? Can this sandbox be configured?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
- 123
1
vote
0
answers
859
views
File Upload Vulnerability SVG [closed]
I am currently doing a bug bounty program and was testing the company's file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded ...
- 143
0
votes
2
answers
2k
views
How to prevent XSS attacks in ASP web application [closed]
In my web application, while doing the penetration testing two XSS vulnerabilities identified in some text input.
that field testing using followin cheets,
<script src="http://192.168.1.122:3000/...
- 101
11
votes
2
answers
13k
views
Is there a way to execute XSS in an HTML img tag with SVG?
Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag?
I know a way to execute without <script> tag, but I don't ...
- 113
5
votes
1
answer
4k
views
How to exploit SVG xlink-based SSRF
First, let me summarize how the SSRF works:
1) You setup an SVG image with a reference to your server via xlink. Here's an example that works:
<?xml version="1.0" encoding="UTF-8" standalone="no"?...
- 501
1
vote
1
answer
590
views
XSS using SVG: Is AllowScriptAccess attribute ignored?
I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet:
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
- 143
2
votes
1
answer
155
views
Why/how is browser inserting inline SVGs at end of body?
Chrome is inserting the following SVG images at the bottom of pages:
<span style="width: 24px; height: 24px; background: url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
- 121
8
votes
2
answers
4k
views
Restrict JS in SVGs
Does anyone know of a way to prevent JS from running inside of an SVG or stripping out JS from an SVG? In my use case I'd prefer to keep the image as an SVG and not convert it to a JPG. I've thought ...
- 349
4
votes
1
answer
360
views
Could an SE question that runs an SVG from a private website potentially be dangerous?
This SE question (now deleted, so not easily viewed) contains an animated SVG that loads from a private website instead of the usual GIF's hosted by imgur. The line is:
- 1,409
9
votes
1
answer
2k
views
SVG files and billion laughs attack
SVG files are susceptible to billion laughs attack. Our website allows users to upload/submit markdown files and we run the .md file through marked.js before rendering it. Now images in the markdown ...
- 191
0
votes
1
answer
431
views
SVG virus/ malware with an extension on Google Chrome (one) [closed]
This question is about the SVG virus malware I got through Facebook, which adds a malicious Google Chrome extension. It's called one or ubo. Some articles write that it is ransomware.
I think I ...
- 11
15
votes
2
answers
16k
views
How to prevent XSS in SVG file upload?
Currently assessing an application, I found out that it is possible to submit an SVG file containing JavaScript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
- 161
-1
votes
1
answer
2k
views
Svg width element XSS
I'm working on a svg image generator. Now I want to set the user width and height value.
Can a user exploit this element tags? And what should I do to make this secure?
<?php
$user_input = $...
- 101
3
votes
1
answer
3k
views
Can an XXE (XML External Entity) attack be carried out from within an SVG file?
Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
- 33
3
votes
1
answer
263
views
Is it safe to allow arbitrary image formats in comments?
I know it’s not safe to allow arbitrary images in comments without proxying.
I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
- 1,492
1
vote
3
answers
2k
views
XSS in the context of a CDN
Say there is a website example.com. It hosts static content from a CDN, example.net.
This site allows uploading an image, which will then be served from the CDN.
This images can be SVGs and they are ...
- 189
4
votes
2
answers
540
views
Securely render SVG
How can I securely render SVG documents in a media sharing application?
I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an <...
- 495
0
votes
2
answers
273
views
SVG-Snippets in Access-Log: Probe or Error?
I get some hits every then and there from different IPs, always the same scheme:
GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 (...
- 3,494
16
votes
2
answers
5k
views
Why does this XSS vector work in svg but not in HTML?
Why does this vector :
<svg><script>alert(/1/.source)</script>
works in http://jsfiddle.net/ZgPY4/2/ and
this one
<script>alert(/1/.source)</...
- 1,452