New CSS Injection Technique Enables Data Exfiltration via Inline Styles
PortSwigger researcher Gareth Heyes has discovered a novel method for exfiltrating sensitive data using CSS injection within inline style attributes, eliminating the need for external stylesheet imports. This technique leverages newly introduced CSS conditional statements (if/else) combined with the attr() and image-set() functions. By chaining nested conditionals, attackers can brute-force attribute values, such as user IDs or usernames, by triggering background requests to attacker-controlled domains based on specific character matches. The research highlights that while previous methods required stylesheet imports, this new vector works directly within style attributes, significantly expanding the potential attack surface for Cross-Site Scripting (XSS) vulnerabilities. Currently, this exploit is limited to Chromium-based browsers due to their support for CSS conditionals. The article provides proof-of-concept code demonstrating how to steal data from attributes like data-uid and data-username. An update notes that the payload can be further optimized by removing url() syntax. This discovery underscores the evolving risks of CSS injection and provides security professionals with new insights for testing and mitigating client-side data leakage vulnerabilities in web applications.
Wire timeline
New CSS Injection Technique Enables Data Exfiltration via Inline Styles
PortSwigger researcher Gareth Heyes has discovered a novel method for exfiltrating sensitive data using CSS injection within inline style attributes, eliminating the need for external stylesheet imports. This technique leverages newly introduced CSS conditional statements (if/else) combined with the attr() and image-set() functions. By chaining nested conditionals, attackers can brute-force attribute values, such as user IDs or usernames, by triggering background requests to attacker-controlled domains based on specific character matches. The research highlights that while previous methods required stylesheet imports, this new vector works directly within style attributes, significantly expanding the potential attack surface for Cross-Site Scripting (XSS) vulnerabilities. Currently, this exploit is limited to Chromium-based browsers due to their support for CSS conditionals. The article provides proof-of-concept code demonstrating how to steal data from attributes like data-uid and data-username. An update notes that the payload can be further optimized by removing url() syntax. This discovery underscores the evolving risks of CSS injection and provides security professionals with new insights for testing and mitigating client-side data leakage vulnerabilities in web applications.
PortSwigger Research