New SVG Technique Enables Highly Interactive Clickjacking Attacks

Cybersecurity: SVG Clickjacking Technique

Security researchers have identified a new web exploitation method known as "SVG clickjacking." This technique enhances the complexity of traditional user-interface redress attacks.

SVG clickjacking diverges from typical clickjacking, which often involves misleading users into clicking concealed buttons on a static overlay. Instead, it enables attackers to construct intricate, interactive fake interfaces that overlay legitimate websites.

This method exploits Scalable Vector Graphics (SVG) filters. These filters, typically used for visual effects such as blurring or color shifting, are repurposed as a functional logic engine.

Researcher Lyra Horse discovered that standard SVG elements like feColorMatrix , feDisplacementMap , and feComposite can be combined to emulate logic gates (e.g., AND, OR, XOR). This allows attackers to construct a functional "program" within the browser's rendering engine.

These filters can process pixels from a cross-origin iframe and respond to on-screen events in real-time. For instance, the script can detect whether a dialog box is open, a checkbox is selected, or error text appears on the target site. Based on this visual data, SVG filters can dynamically update the fake overlay shown to the user.

This attack technique creates the illusion that users are interacting with benign elements such as games or captchas. In reality, they may be engaging with sensitive applications, like document editing or email services.

A proof-of-concept demonstrated how this could be used to manipulate Google Docs, tricking users into creating documents under the guise of solving puzzles, while the genuine interface remains hidden.

Google recognized this vulnerability by awarding a $3,133.70 bug bounty, highlighting the severity of the threat.

This technique also facilitates novel data exfiltration methods. Researchers showed that sensitive pixel data from a target site could be embedded into a QR code generated solely by SVG filters. An attacker could then prompt users to scan the code, indirectly obtaining information from secure websites without accessing the page's code.

Trick the user into marking themselves as hacked

This research signifies a shift in browser-based threat landscapes, demonstrating that visual elements can be exploited to perform unauthorized actions. By utilizing the browser's graphical rendering tools as a logic engine, SVG clickjacking challenges traditional web attack assumptions.

Based on reporting by GBHackers.