Upload files - XSS with HTML, XML, SVG files

[tag9724]

HTML, XML and SVG can be uploaded and displayed directly in the page, opening the website to XSS attacks.

CSP are set to block inline script execution but it can be easily bypass by uploading a JS file and then include it inside the HTML, XML or SVG document, CSP should not be trusted to prevent XSS attacks.

These files should be displayed as plain text or forced to download when opening their urls.

Examples

First we upload the JS file, it will give us the url https://u.teknik.io/c9X1t.js

alert("Js Alert");

Using HTML

<script src="https://u.teknik.io/c9X1t.js"></script>

Using XML

<xhtml:script xmlns:xhtml="http://www.w3.org/1999/xhtml" src="https://u.teknik.io/c9X1t.js" type="application/javascript"/>

Using SVG

<svg xmlns="http://www.w3.org/2000/svg">
	<script href="https://u.teknik.io/c9X1t.js"></script>
</svg>