New SVG Clickjacking Attack Let Attackers Create Interactive Clickjacking Attacks
Clickjacking is a well-known technique where attackers overlay an invisible frame over a legitimate webpage to trick users into performing unintended actions. A new variant, named SVG clickjacking , has been developed by a researcher known as Lyra. This…
Clickjacking is a well-known technique where attackers overlay an invisible frame over a legitimate webpage to trick users into performing unintended actions. A new variant, named SVG clickjacking , has been developed by a researcher known as Lyra. This technique significantly alters the landscape of clickjacking attacks by making them more interactive and capable of reading screen content.
The SVG clickjacking technique utilizes Scalable Vector Graphics (SVG) filters to create overlays that can detect the state of a target website and respond accordingly. The core vulnerability lies in the way modern browsers process SVG filters such as feDisplacementMap , feColorMatrix , and feComposite . These filters, originally designed for graphical effects, are repurposed to perform logical operations.
By chaining these filters, attackers can create logic gates (AND, OR, XOR) within the browser’s rendering engine. This allows the attack to monitor a cross-origin iframe, dynamically updating the interface based on the user's interactions.
Lyra demonstrated the severity of this technique with a proof-of-concept attack against Google Docs, which earned a $3,133.70 bounty from Google’s Vulnerability Reward Program. In this demonstration, the attacker guided the user through a process involving fake captcha entry and button sequences.
A new variant, named SVG clickjacking , has been developed by a researcher known as Lyra.
The attack adapts to the document’s state, showing or hiding elements as needed. Such capabilities mark a significant escalation in "UI redress" attacks, challenging the assumption that visual obscurity can prevent clickjacking.
Data Exfiltration and Security Concerns
An advanced application of SVG clickjacking involves data exfiltration. The technique can read sensitive pixels from a target site and encode this data into a URL, which is then converted into a QR code. This QR code can be misleadingly presented to users as a verification step, while actually containing embedded session data or private information.
This research highlights the need for enhanced security measures against interactive and responsive clickjacking attacks.
Based on reporting by Cyber Security News.