Currently assessing an application, I found out that it is possible to submit an SVG file containing JavaScript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those vulnerabilities and secure the SVG submission form? How to be sure that all obfuscation methods are caught?
In the first place, I developed a blacklist approach but from a security point of view, it is a very very bad approach. What advice would you give me?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Answered on Feb 8, 2022
While @ThorTL67 points out some completely valid solutions, I don't feel comfortable with any of them, and they seem kinda irresponsible to me. This is because any malicious JS within the SVG XSS is still sent to the viewer. This means that if they happen to save the SVG file and then view it, any malicious JavaScript will still be executed on their device, since on most devices the only software that can view SVGs are browsers. This is especially true for the first point in @ThosTL67's answer. Here are some alternate recommendations: You can convert the SVG to another format server-side (such as PNG) and then display the new image. You can sanitise SVGs using libraries
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Ethical Hacker Roles and Responsibilities: What Do Ethical Hackers Actually Do?
What does an ethical hacker actually do? See the five-phase process, daily tasks, required skills, and where ethical hackers work.
Cyber Security Penetration Tester Roles and Responsibilities: What Does a Pen Tester Do?
Learn what a penetration tester does, including key roles, responsibilities, daily tasks, tools, skills, reporting, and…
Cyber Security GRC Analyst Roles and Responsibilities: What Does a GRC Analyst Do?
What does a GRC analyst actually do? See the core responsibilities, how they grow by experience level, a daily routine, tools,…
Cyber Security SOC Analyst Roles and Responsibilities: What Does a SOC Analyst Do?
What does a SOC analyst actually do? Explore core responsibilities, the Tier 1–3 structure, daily tasks, tools, and skills in…
