Full Disclosure mailing list archives
Re: Trigerring Java code from a SVG image
From: Nicolas Grégoire <nicolas.gregoire () agarri fr>
Date: Wed, 16 May 2012 13:27:47 +0200
Probably the most interesting SVG thing is how they either do or don't have script access, depending on whether or not they're loaded as <img>'s.
Agreed. Uploading a SVG chameleon (SVG file triggering a XSLT transformation) to a website allows to display nearly arbitrary content if the file is called directly. This is similar to the WXR upload feature abused by the MSVR team in order to XSS the Wordpress.com website (as presented at 27C3).
It would be problematic indeed if <img src="foo.jpg"> could suddenly render script!
Mario's research have shown some weird behavior in Opera. There's an online demo of SVG files loaded via <img> and starting some plugins (Java / Flash / PDF): http://heideri.ch/opera/ And there's even a trick involving "favicon.ico" ! Paper: http://www.nds.rub.de/research/publications/SVG-security-risks/ Slides: https://www.owasp.org/images/a/aa/The_image_that_called_me.pdf Regards, Nicolas _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Trigerring Java code from a SVG image Nicolas Grégoire (May 16)
- Re: Trigerring Java code from a SVG image Dan Kaminsky (May 16)
- Re: Trigerring Java code from a SVG image Michele Orru (May 16)
- Re: Trigerring Java code from a SVG image Dan Kaminsky (May 16)
- Re: Trigerring Java code from a SVG image Krzysztof Kotowicz (May 16)
- Re: Trigerring Java code from a SVG image Michele Orru (May 16)
- Re: Trigerring Java code from a SVG image Nicolas Grégoire (May 16)
- Re: Trigerring Java code from a SVG image Nicolas Grégoire (May 16)
- Re: Trigerring Java code from a SVG image Michele Orru (May 17)
- Re: Trigerring Java code from a SVG image Dan Kaminsky (May 16)