# SSRF in PDF Renderer using SVG

SVG-to-PDF converter accepted foreignObject-embedded HTML iframes, letting an attacker SSRF the AWS metadata endpoint and exfiltrate instance credentials.

- Payout: $2,150
- Severity: high
- Program: -
- Credited: pwn.vg / Tomi
- Disclosed: 2021-05-19
- Write-up quality: 6/10
- Original: https://pwn.vg/articles/2021-05/ssrf-in-pdf-renderer-using-svg
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-vg-articles-2021-05-ssrf-in-pdf-renderer-using-svg
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:aws technique:chained vuln:ssrf

**Target:** SVG-to-PDF/JPG/PNG conversion endpoint (/convert)
**Root cause:** The renderer (PhantomJS) processed SVG input but allowed foreignObject to embed XHTML iframes, so attacker-controlled HTML was fetched server-side without restricting outbound requests to internal/metadata addresses.
**Steps:**
1. POST multipart/form-data to `/convert` with field `svg` containing raw `<iframe src=...>` — rejected as invalid SVG.
2. Wrap the iframe in `<svg><g><foreignObject><body xmlns="http://www.w3.org/1999/xhtml"><iframe src="http://COLLABORATOR">` to pass SVG validation.
3. Observe Burp Collaborator hit confirming server-side fetch; UA reveals PhantomJS on AWS.
4. Swap iframe src to `http://169.254.169.254/latest/meta-data/` and resubmit to read instance metadata.
**How found:** Spotted a user-input-to-PDF/SVG conversion feature and hypothesized server-side rendering; initial raw iframe failed validation, so researched SVG embedding and found foreignObject to smuggle HTML past the SVG parser.
**Exploitation:** Attacker submits a crafted SVG via the conversion endpoint; the server-side PhantomJS renderer loads the embedded iframe, issuing an HTTP request to the AWS link-local metadata service. The rendered output/response leaks metadata content back to the attacker.
**Escalation:** Pivoted from blind SSRF confirmation (Collaborator hit) to reading AWS EC2 instance metadata, potentially yielding IAM credentials for cloud takeover.
**Insight:** When a service validates 'SVG only', try `<foreignObject>` with an XHTML `<body>` to smuggle iframes/HTML into the renderer — it bypasses naive SVG-only checks and turns image/PDF converters into SSRF primitives against 169.254.169.254.