Comment on Adult sites are stashing exploit code inside svg filesparentComments−lostmsu1yWhat's the hole? Neither appear to say.−throwaway2901yI guess that obfuscated JS in SVG runs? Then it downloads the script that does shady stuff−lostmsu1yThat does not explain exactly what is wrong. The site could already run JS. It did not need SVG to do it.−throwaway2901yYeah I guess the original article is not clear on that. Other cases usually involved email but this is not
Comments
What's the hole? Neither appear to say.
I guess that obfuscated JS in SVG runs? Then it downloads the script that does shady stuff
That does not explain exactly what is wrong. The site could already run JS. It did not need SVG to do it.
Yeah I guess the original article is not clear on that. Other cases usually involved email but this is not