Fast Feed

SAR 2,629 For Stored XSS via svg Image Leading to ATO

3 min read

Summary

Hacking via Pictures: Stored XSS via SVG Leading to Account Takeover Hello everyone! 👋 In this write-up, I want to share an interesting finding: a Stored Cross-Site Scripting (XSS) vulnerability hidden inside a profile picture upload feature. By simply uploading a malicious SVG image, I was able to execute JavaScript code and steal authentication tokens stored in localStorage, leading to a full Account Takeover. Let’s dive into how it happened! The Discovery While hunting on a program from the BugBounty.sa platform, I focused on the user profile settings. I noticed the application allowed users to upload profile pictures, so I immediately checked if it accepted SVG (Scalable Vector Graphics) files. During my reconnaissance, I found three critical pieces of information that made this attack possible:

  • Storage Mechanism: I inspected the application’s storage and found that the session credentials (authentication tokens) were stored in the browser’s localStorage.
  • Same-Origin Hosting: I noticed that uploaded photos were hosted self-hosted on the same domain (e.g., [https://redacted.com/photos/...](https://redacted.com/photos/…`)) rather than on a separate CDN or sandbox domain. This is crucial because scripts running inside the image share the same origin as the main application, allowing them to access localStorage.
  1. Missing CSP: The application had a missing or misconfigured Content Security Policy (CSP), allowing inline scripts to execute. Steps to Reproduce
  2. Navigate to the Target I logged into my account and went to the Account Details page. URL: [https://](https://my.hcloud.sa/account/details)redacted[.com/account/details](https://my.hcloud.sa/account/details)
  3. Create the Malicious Payload I set up a listener on webhook.site to capture the stolen data. Then, I created a file named exploit.svg. Inside this file, I embedded a script to grab the token from localStorage and send it to my webhook.
  • The Payload:*
3. Upload the Image I clicked the upload button and selected my exploit.svg file. The application accepted it without any errors! ✅ Get Anas NadY’s stories in your inbox Join Medium for free to get updates from this writer. Once uploaded, I right-clicked the profile image and selected “Open image in new tab”. As soon as the browser rendered the SVG, the JavaScript executed. 💥 - An alert box popped up with the token. - The token was silently sent to my webhook listener. The Impact This wasn’t just a simple popup. By accessing localStorage , I could extract the Authentication Token. With this token, an attacker can: - Take over the account without a password. - View sensitive personal information (PII). - Perform actions on behalf of the victim (admin or user). Remediation To fix this, developers should: - Sanitize SVGs: Remove