{% extends "base.html" %} {% block title %}Lab Tasks - CVE-2026-5026 Lab{% endblock %} {% block content %}

Lab Tasks

CVE-2026-5026 - Stored XSS via Malicious SVG Upload

Progress

Task 1 - Basic XSS Alert

Upload an SVG that triggers alert("Task 1 complete with success!!") when rendered.

Task 2 - Cookie Exfiltration

Send session cookie to attacker-controlled listener

Task 3 - Authenticated Action

POST on behalf of victim, capture the flag

Why SVGs are dangerous

Unlike JPEG or PNG, SVG files are XML documents parsed and executed by the browser. Any <script> tag or event handler (e.g. onload=) inside an SVG runs in the context of the hosting page — with full access to document.cookie, the DOM, and the user's authenticated session.

When the server stores and serves these files inline without sanitization, any user who views the file executes the attacker's code — this is Stored XSS.

Mitigations

1. SVG Sanitization (DOMPurify)

DOMPurify.sanitize(svgContent, {USE_PROFILES: {svg: true}})

2. Content Security Policy

Content-Security-Policy: default-src 'self'; script-src 'none'

3. Serve SVGs as attachment (not inline)

Content-Disposition: attachment; filename="file.svg"
X-Content-Type-Options: nosniff

4. Server-side MIME validation

if file.content_type != 'image/svg+xml': reject()

5. HttpOnly cookies + CSRF tokens

app.config['SESSION_COOKIE_HTTPONLY'] = True
# + flask-wtf for CSRF protection
{% endblock %} {% block scripts %} {% endblock %}