Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

This lab isolates SVG SMIL event filter bypass. The filter rejects common HTML and events but permits svg, animate/animateTransform, and the SVG animation event onbegin. The SMIL animation begins during document processing, so its allowed onbegin handler runs without a click.

Lab objective/setup

Open the Academy exercise at the reserved lab URL and work only in that disposable environment. The required proof is specific: The automatic alert appears and the lab records success.

What I observed

The filter rejects common HTML and events but permits svg, animate/animateTransform, and the SVG animation event onbegin. The SMIL animation begins during document processing, so its allowed onbegin handler runs without a click.

Academy objective states that common tags are blocked but some SVG tags and events remain available for an alert call.
Academy objective states that common tags are blocked but some SVG tags and events remain available for an alert call.
Search field contains an inert SVG `onload` probe, used to establish that the obvious event is filtered.
Search field contains an inert SVG `onload` probe, used to establish that the obvious event is filtered.
Application rejection message reads “Event is not allowed,” confirming that `onload` is blocked.
Application rejection message reads “Event is not allowed,” confirming that `onload` is blocked.

Why it is vulnerable

The application applies protection for the wrong parser or omits a control at the decisive boundary. In this case, the filter rejects common HTML and events but permits svg, animate/animateTransform, and the SVG animation event onbegin. Browser parsing therefore preserves the attacker-controlled behavior instead of reducing the value to inert text or a safe URL.

Walkthrough in the authorized PortSwigger lab

First reproduce the recorded page or request and inspect the exact reflected, stored, or DOM-generated context described above. Then supply the following lab payload as data, not as active markup in this article:

1
`<svg><animatetransform onbegin=alert(1)>`

The SMIL animation begins during document processing, so its allowed onbegin handler runs without a click.

Burp Intruder tag-enumeration results return status 200 for `svg`, `animate`, and `animatetransform` while common HTML tags return 400.
Burp Intruder tag-enumeration results return status 200 for `svg`, `animate`, and `animatetransform` while common HTML tags return 400.
Burp Intruder event-enumeration results identify `onbegin` as an accepted SVG animation event in the reflected search request.
Burp Intruder event-enumeration results identify `onbegin` as an accepted SVG animation event in the reflected search request.
Browser alert dialog showing `1` after the allowed `animateTransform` element fires its `onbegin` handler during parsing.
Browser alert dialog showing `1` after the allowed `animateTransform` element fires its `onbegin` handler during parsing.

Verification

The automatic alert appears and the lab records success. This distinguishes execution from a payload merely appearing in source or being stored without reaching the required event or sink.

Impact and defensive lesson

In a real application, equivalent XSS could act with the victim’s same-origin privileges, expose readable data, or perform authenticated actions. Fix the data flow at its context: use text-only DOM APIs, JavaScript- or attribute-aware encoding, strict URL-scheme allowlists, and maintained sanitization where HTML is unavoidable. HttpOnly cookies and a restrictive CSP reduce consequences but do not repair the injection flaw.

References