Listen to this Post
Introduction
SVG (Scalable Vector Graphics) files are widely used for web graphics but can be weaponized to execute cross-site scripting (XSS) attacks. Recent research by Gareth Heyes demonstrates how Chrome and Safari fail to properly escape malicious SVG content, unlike Firefox. This article explores the exploit, provides verified commands for testing, and outlines mitigation strategies.
Learning Objectives
- Understand how SVG-based XSS exploits work.
- Identify vulnerable browsers using proof-of-concept (PoC) code.
- Implement hardening measures to prevent SVG exploitation.
You Should Know
1. SVG XSS Exploit PoC
Code Snippet:
<svg><title><![CDATA[--></title><img src onerror=alert(1)>]]>
Step-by-Step Guide:
- Test in Browsers: Paste the above code into an HTML file and open it in Chrome, Safari, and Firefox.
– Firefox: Escapes the payload, preventing execution.
– Chrome/Safari: Execute `alert(1)` due to improper escaping.
2. Impact: Attackers can replace `alert(1)` with malicious JavaScript (e.g., cookie theft).
2. Mitigation via Content Security Policy (CSP)
Command (HTTP Header):
Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline'
Steps:
- Add the CSP header to your web server configuration (e.g., Apache/Nginx).
- Test with the PoC—the `alert(1)` will now be blocked unless explicitly allowed.
3. Browser-Specific Hardening
For Chrome Extensions:
"content_security_policy": "script-src 'self'; object-src 'none'"
Steps:
1. Add this to your extension’s `manifest.json`.
2. Prevents inline script execution in extensions.
4. Server-Side SVG Sanitization
Python (Using `lxml`):
from lxml import etree def sanitize_svg(svg_content): parser = etree.XMLParser(resolve_entities=False) tree = etree.fromstring(svg_content, parser) return etree.tostring(tree)