· javascript
Scalable Vector Grief tests SVG sanitizers, bypasses six, shows header JS execution in Firefox
Six out of eight common SVG sanitizers I tested were successfully bypassed during my security assessment.
This investigation reveals a vulnerability where a response header can execute JavaScript within Firefox. This exploit works even if the response body contains only benign XML.
The findings detail the methods used to circumvent these established sanitization tools.
The demonstration focuses on how the response header itself facilitates the code execution.
This technique proves that even seemingly harmless XML payloads are insufficient to prevent the attack.
