Paragon Initiative Enterprises · Report #148853
Stored XSS using SVG
Validstatus
15upvotes
2 Jul 2016disclosed
Summary
The way browsers handle SVG files is terrible. If you're serving SVG files that your users can upload, only allow them to be served as text/plain.
How it was found
Hi ,
Background
I had problem in setup the airship at ubuntu so I tested on your site .
If you uploads any file thet can use for XSS (HTML,SWF,etc) the content type will change to "text/plain; charset=us-ascii" . But for images it will stay the same . so if you upload SVG with JS content it will work fine !
The "Content-Type: image/svg+xml; charset=us-ascii" header will make this attack works .
Just upload the svg file to the site .
PoC
{F102954}
SVG's is not good sometimes to view as image and it will be stored in users accounts.
Thanks