Advanced XSS Evasion Techniques: Hiding Payloads in SVG and Math Elements

By /

Listen to this Post

Featured Image

Introduction:

Cross-Site Scripting (XSS) remains a prevalent web application vulnerability, but modern defenses like Web Application Firewalls (WAFs) and custom sanitizers have made exploitation harder. Security researchers are now leveraging SVG and MathML elements to bypass these protections. This article explores how attackers hide XSS payloads in these elements and provides actionable mitigation strategies.

Learning Objectives:

  • Understand how SVG and MathML elements can conceal XSS payloads.
  • Learn detection and mitigation techniques for such evasion methods.
  • Apply hardening measures for web applications to prevent advanced XSS attacks.

1. SVG-Based XSS Payloads

Verified Payload:


<

svg onload=alert('XSS')>

Step-by-Step Explanation:

  1. How It Works: SVG supports event handlers like onload, which executes JavaScript when the SVG loads.
  2. Bypass Technique: Many sanitizers miss SVG-specific attributes, allowing this payload to slip through.
  3. Usage: Inject this into an application’s input field or URL parameter to test for XSS vulnerabilities.

2. MathML Payload Concealment

Verified Payload:

<math href="javascript:alert('XSS')">CLICK ME</math>

Step-by-Step Explanation:

  1. How It Works: MathML’s `href` attribute can execute JavaScript when clicked.
  2. Bypass Technique: WAFs often overlook MathML, assuming it’s benign markup.
  3. Usage: Embed this in a vulnerable application to test for click-based XSS.

3. Combining SVG and Obfuscation

Verified Payload:

<svg><script>alert('XSS')</script></svg>

Step-by-Step Explanation:

  1. How It Works: Some sanitizers strip `