Java – Trigerring Java Code from a .SVG Image

• Exploit Database
• 18 阅读

• 作者： Nicolas Gregoire
  日期： 2012-05-16
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/18890/

• SVG is a XML-based file format for static or animated images. Some SVG
  specifications (likeSVG 1.1 and SVG Tiny 1.2) allow to trigger some
  Java code when the SVG file is opened.
  
  Given that I had to look at these features for a customer, I developed
  some PoC codes which are now available online:
  
  http://www.agarri.fr/docs/batik-evil.svg
  http://www.agarri.fr/docs/batik-evil.jar
  
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18890.svg
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18890.jar
  
  I published a more detailed article on my blog:
  http://www.agarri.fr/blog/
  
  Regards,
  Nicolas Grégoire / @Agarri_FR