undefined | Better HN

0 pointsnneonneo8mo ago0 comments

It's recursive, but not XXE. It is 20 layers of nested SVG groups, where the first group contains 10 blue circles, and every subsequent group contains 10 of the previous group. This would render as around 10^20 blue circles.

0 comments

pcthrowaway8mo ago

SVG is XML-based, unlike HTML which follows the SGML spec

From curling the malicious page you can also see:

    <?xml version="1.0" encoding="UTF-8"?>
        <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1000" height="1000">

nneonneoOP8mo ago

Yes, SVGs are XML-based and may be vulnerable to generic XML-based XML external entity (XXE) or exponential entity expansion attacks, but this particular malicious SVG is using SVG-specific features to create the resource exhaustion.

j / k navigate · click thread line to collapse