Large-Scale Analysis of Style Injection by Relative Path Overwrite

Abstract

Relative Path Overwrite (RPO) is a recent technique to inject style directives into sites even when no style sink or markup injection vulnerability is present. It exploits differences in how browsers and web servers interpret relative paths (i.e., path confusion) to make a HTML page reference itself as a stylesheet; a simple text injection vulnerability along with browsers' leniency in parsing CSS resources results in an attacker's ability to inject style directives that will be interpreted by the browser. Even though style injection may appear less serious a threat than script injection, it has been shown that it enables a range of attacks, including secret exfiltration.In this paper, we present the first large-scale study of the Web to measure the prevalence and significance of style injection using RPO. Our work shows that around 9 % of the sites in the Alexa Top 10,000 contain at least one vulnerable page, out of which more than one third can be exploited. We analyze in detail various impediments to successful exploitation, and make recommendations for remediation. In contrast to script injection, relatively simple countermeasures exist to mitigate style injection. However, there appears to be little awareness of this attack vector as evidenced by a range of popular Content Management Systems (CMSes) that we found to be exploitable.

An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources

“…Another body of work focuses on the issues related to the inclusion of third-party subresources and trackers in webpages [4,7,31,32,35,41]. Arshad et al [5] perform the rst large-scale analysis of scriptless CSS injection. They show that around 9% of 10k most popular websites contain at least one vulnerable page, out of which more than one third can be exploited.…”

A Security-Oriented Analysis of Web Inclusions in the Italian Public Administration

“…Resources of type iframe are, essentially, equivalent to scripts used for drive-by attacks [31,32]. The other resource types can be misused only for attempting to inject malware in the browser, by exploiting vulnerabilities in the browser code for handling the corresponding resources [33][34][35][36].…”

Studying the Privacy Issues of the Incorrect Use of the Feature Policy

“…Another research found that because of the browser failing to ask permission, websites were able to read the battery status and profile users accordingly [30]. Previous studies [8], [9], [10] focused on adoption of response headers in general or in particular such as Content Security Policy [11], [12] and Referrer Policy [13]. Studies showed that unless these policies are used correctly both by server-side and client-side, they do not protect against possible attacks.…”

“…Previous studies focused on the adoption of response headers and their security and privacy implications [8], [9], [10], [11], [12], [13]. In other work [14], [15], researchers proposed sandboxing scripts as a countermeasure to data leakage.…”