Blind CSS Exfiltration: Extracting Data from Unknown Web Pages
PortSwigger researcher Gareth Heyes introduces a novel technique called Blind CSS Exfiltration, designed to extract data from web pages where JavaScript execution is blocked by Content Security Policies or sanitization filters like DOMPurify. This method exploits blind HTML injection vulnerabilities by leveraging CSS capabilities, specifically combining attribute selectors with the new :has selector and CSS variables. The process involves injecting styles that trigger background image requests to an external server only when specific conditions are met, such as an input value starting with a certain character. By using CSS variables as conditional switches with fallbacks, attackers can exfiltrate form elements and anchor tags without direct visual feedback. Heyes demonstrates how to confirm injection via Out-of-band Application Security Testing (OAST) using Burp Collaborator. This technique significantly expands the potential impact of CSS injection vulnerabilities, allowing data theft even in restricted environments where traditional Cross-Site Scripting (XSS) is mitigated. The research highlights the critical need for robust input validation beyond just script filtering, as style injections can still lead to significant data leakage through side-channel requests.
Wire timeline
Blind CSS Exfiltration: Extracting Data from Unknown Web Pages
PortSwigger researcher Gareth Heyes introduces a novel technique called Blind CSS Exfiltration, designed to extract data from web pages where JavaScript execution is blocked by Content Security Policies or sanitization filters like DOMPurify. This method exploits blind HTML injection vulnerabilities by leveraging CSS capabilities, specifically combining attribute selectors with the new :has selector and CSS variables. The process involves injecting styles that trigger background image requests to an external server only when specific conditions are met, such as an input value starting with a certain character. By using CSS variables as conditional switches with fallbacks, attackers can exfiltrate form elements and anchor tags without direct visual feedback. Heyes demonstrates how to confirm injection via Out-of-band Application Security Testing (OAST) using Burp Collaborator. This technique significantly expands the potential impact of CSS injection vulnerabilities, allowing data theft even in restricted environments where traditional Cross-Site Scripting (XSS) is mitigated. The research highlights the critical need for robust input validation beyond just script filtering, as style injections can still lead to significant data leakage through side-channel requests.
PortSwigger Research