1

This question already has an answer here:

I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website.

I understand that this is potentially a tool for csrf or stealing url parameters. But on its own, should it be considered a security vulnerability?

edit: Question is primarily about whether this is a vulnerability in its own right, rather than how this could possibly be used to create further exploits.

marked as duplicate by tim, Serge Ballesta, Xiong Chiamiov, Anders, Matthew Mar 23 '17 at 12:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

If you are not the web site author/admin, and you can (as a site user) add a stylesheet to a page, then this could be an attack vector--though arguably not a full-blown vulnerability.

For example, one could link a style to an image on a web server of their choosing and log the requests. This would reveal data from all page visitors (IP addresses and user agents) which can then be used for further attacks.

  • 4
    I would definitely call CSS injection a full-blown vulnerability. Sure, it's not as powerful as eg XSS, but you can do more than just log who visits a page (which you could eg also do when you can include an image). With CSS, you can partly control what is displayed on the page, and you can in some situations read out data that is shown as well (which is an issue in itself, and which may in turn enable more serious attacks such as CSRF). – tim Mar 22 '17 at 20:07
  • Agreed you could do more than log who visits a page. – brirus Mar 22 '17 at 20:22
  • Great answers, would like to add: Defamation of a website can have a serious impact on any organisation. Say I set an IS background image with propaganda or something? (I am not a CSS expert) – Wealot Mar 23 '17 at 7:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.