The use of Scalable Vector Graphics (SVG) as a delivery mechanism for malicious activity represents a persistent challenge for traditional security perimeters. Unlike raster images such as JPEG or PNG, SVG files are XML-based documents. This architectural difference allows them to host interactive elements, including CSS and JavaScript, which browsers execute when the file is rendered. According to Jan Kopriva at SANS ISC, attackers are leveraging these capabilities to facilitate Phishing and credential harvesting by embedding script blocks directly within the image code.
Technical Analysis: Embedding Malicious Payloads in Scalable Vector Graphics
Because an SVG is a structured XML document, it follows the Document Object Model (DOM). This allows an attacker to use the <script> tag or event-handler attributes such as onload or onclick to execute arbitrary code. When a victim opens a malicious SVG file—often delivered as an email attachment or via a link—the browser treats the file as a standalone document. If the file contains JavaScript, the browser’s engine will execute it within the context of the file’s origin.
Attackers utilize SVG file phishing techniques to bypass common security filters that primarily look for known malicious file extensions or signatures. Many EDR and email security gateways are configured to allow image formats by default, assuming they are inert data. However, the XML nature of SVG allows for sophisticated obfuscation. For instance, an attacker might use Base64 encoding for the script content or employ various TTP methods to hide the final URL of a credential harvesting site.
In many cases, the JavaScript embedded in the SVG is designed to redirect the user to a fraudulent login page. Alternatively, it can be used to perform XSS attacks if the SVG is uploaded to a vulnerable web application that serves the file back to users without proper sanitization. This is particularly dangerous in multi-user environments where a user might upload an ‘avatar’ or ‘logo’ that, when viewed by an administrator, executes a script to steal session cookies.
Mitigating SVG-Based XSS Attacks and Malware Delivery
Defenders must recognize that traditional signature-based detection is often insufficient for detecting malicious javascript in svg files. Because the code is legitimate XML, security tools must perform deep content inspection or rely on behavioral analysis. A SOC should prioritize the implementation of specific security headers and sanitization protocols to reduce the risk surface.
One of the most effective strategies for mitigating SVG-based XSS attacks is the enforcement of a strict Content Security Policy (CSP). By setting a Content-Security-Policy: default-src 'self'; script-src 'none'; header when serving SVG files, administrators can prevent the execution of any embedded scripts. Additionally, using the Content-Disposition: attachment header forces the browser to download the file rather than rendering it inline, which prevents the script from executing in the browser context.
For organizations that must allow users to upload SVG files, it is vital to use sanitization libraries like DOMPurify. These libraries can parse the XML and strip out dangerous tags and attributes before the file is stored. Integrating these checks into a SIEM can help identify an IoC associated with frequent uploads of active XML content, which may indicate a targeted campaign.
Related: GlassWorm Malware: Detecting Obfuscated Payloads in Browser Extensions