Detecting and Mitigating SVG Smuggling (T1027.017)

Most people treat an SVG as a picture. It is actually a text file written in XML, and it is allowed to contain script.

MITRE tracks this as SVG Smuggling, technique T1027.017, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.

How attackers use it

Because SVGs are XML, they can legitimately contain script tags, so an adversary can include JavaScript in a file that users and content filters consider an image. MITRE lists several things the content may do: assemble a malicious payload, download one, redirect the user to a malicious site, or show interactive content such as fake login forms and download buttons.

SVG smuggling may be combined with HTML smuggling, with an SVG that carries a payload inside an HTML file. SVGs may also be placed inside other documents, such as PDFs.

How to detect it

MITRE's strategy (DET0510) looks for script execution and delivery behavior right after an SVG shows up:

• Windows. SVG creation or download followed by script engines such as wscript.exe, mshta.exe or rundll32.exe, network callbacks, or browser based credential collection.
• Linux. A downloaded SVG followed by browser processes or tools like xdg-open, then quick network connections or interpreters such as python or bash.
• macOS. SVGs downloaded through a browser that invoke AppleScript, osascript or JavaScriptCore, followed by network egress or files dropped to LaunchAgents or ~/Library.

How to reduce the risk

MITRE lists one mitigation: application isolation and sandboxing. Browser sandboxes can reduce the impact of exploitation, though MITRE cautions that sandbox escapes may still exist.

Practical additions: treat SVG attachments from outside your organization like any other script capable file, and avoid opening them directly in a browser when the sender is unknown.

Quick check

Sources

• MITRE ATT&CK, SVG Smuggling (T1027.017)