full-disclosure - Re: Trigerring Java code from a SVG image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 16 May 2012 13:27:47 +0200
From: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Trigerring Java code from a SVG image

> Probably the most interesting SVG thing is how they either do or don't
> have script access, depending on whether or not they're loaded as
> <img>'s.

Agreed. Uploading a SVG chameleon (SVG file triggering a XSLT
transformation) to a website allows to display nearly arbitrary content
if the file is called directly. This is similar to the WXR upload
feature abused by the MSVR team in order to XSS the Wordpress.com
website (as presented at 27C3).

> It would be problematic indeed if <img src="foo.jpg"> could suddenly
> render script!

Mario's research have shown some weird behavior in Opera. There's an
online demo of SVG files loaded via <img> and starting some plugins
(Java / Flash / PDF): http://heideri.ch/opera/ And there's even a trick
involving "favicon.ico" !

Paper: http://www.nds.rub.de/research/publications/SVG-security-risks/
Slides: https://www.owasp.org/images/a/aa/The_image_that_called_me.pdf

Regards,
Nicolas

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/