# Week 44 - SVG SSRF

Looking for another way of exploiting Server-Side Request Forgery?\
 \
Many [#AppSec](https://www.linkedin.com/feed/hashtag/?keywords=appsec\&highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6999064415689965568) testers are already familiar with server-side HTML rendering, and how an \<iframe> can be used to access internal resources or local files. But did you know this is also possible through exporting SVG images?\
&#x20;\
This is due to the handy \<foreignObject> tag, which essentially allows you to add HTML to the SVG image. Assuming the server is rendering the SVG image, you can add an iframe and link to internal hosts/files like so:\
&#x20;\
`<svg width="1000" height="1000">`\
&#x20;\
&#x20;`<foreignObject width="1000" height="1000">`\
&#x20;\
&#x20;  `<iframe style="width:100%;height:100%;" src="file[:]///etc/passwd"/>`\
&#x20;\
&#x20;`</foreignObject>`\
&#x20;\
`</svg>`\
&#x20;\
If the server is blocking the \<foreignObject> tag, you can find bypasses at the link provided in the comments.

![](https://3053998085-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxZo6Sim2dDXChJQAtNXN%2Fuploads%2F6LaMtRUXXIysKkDJ2HOc%2Fimage.png?alt=media\&token=22e50d81-2358-4fbd-a6c9-382f8410e212)