14

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this way.

Can they do XSS using just the style attribute value in modern browsers?
With 'modern' being IE10+ and newest versions of other browsers.

Improve this question
4
  • You need to provide us with more details about your implementation. Here is a way to exec js using css only stackoverflow.com/questions/476276/using-javascript-in-css - note: This might not work on moderns browsers
    – AK_
    Commented Jun 10, 2014 at 11:27
  • The implementation itself might have other flaws, but to focus my question I am only looking at any XSS problems with style="literally anything valid in an attribute value, as long as it does not break out of an attribute value".
    – Andrey Shchekin
    Commented Jun 10, 2014 at 11:42
  • @AK_ also I've seen those posts, but those seem to talk about older browsers -- I am interested in modern ones.
    – Andrey Shchekin
    Commented Jun 10, 2014 at 11:44
  • I know this question is old, but can we get an update of our definition of what "modern" is? Not that browser version should matter as if you have to consider older browsers, it is still a vulnerability but would be awesome to get an update.
    – aug
    Commented Aug 29, 2017 at 18:56

2 Answers 2

Reset to default
6

I have searched for it everywhere, but I think all modern browsers are safe from XSS into CSS. Although I had one particular test and it got executed into my Chrome (and probably other browsers)

If you application is naively injecting any input into <style>...</style> this interesting scenario can happen:

<html>
<head>
<style>
p {
    text-align: center;
    color: red;
    /*user can inject here*/
    }</style><script>alert()</script>

}
</style>
</head>
<body>

<h1>My First Heading</h1>

<p>My first paragraph.</p>

</body>
</html>

...

OR

p {
    /*injecting into bg's url*/
    background: url("garbage"}</style><script>alert()</script>/*) repeat;
    text-align: center;
    color: red;
}

Obviously .. an XSS

enter image description here

Improve this answer
0
4

Although dangerous tricks such as behavior: url('some.htc') aren't available in modern browsers by default, if you are using the X-UA-Compatible header or meta tag to force Microsoft Internet Explorer in a different render mode, or if you are omitting the document type declaration, Internet Explorer will use the behavior of older versions where such things are available.

A demonstration (note: I can't get this to work on IE 11): http://jsbin.com/siyuhika/1/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .