1

I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website.

I understand that this is potentially a tool for csrf or stealing url parameters. But on its own, should it be considered a security vulnerability?

edit: Question is primarily about whether this is a vulnerability in its own right, rather than how this could possibly be used to create further exploits.

Improve this question
0

1 Answer 1

Reset to default
2

If you are not the web site author/admin, and you can (as a site user) add a stylesheet to a page, then this could be an attack vector--though arguably not a full-blown vulnerability.

For example, one could link a style to an image on a web server of their choosing and log the requests. This would reveal data from all page visitors (IP addresses and user agents) which can then be used for further attacks.

Improve this answer
3
  • 4
    I would definitely call CSS injection a full-blown vulnerability. Sure, it's not as powerful as eg XSS, but you can do more than just log who visits a page (which you could eg also do when you can include an image). With CSS, you can partly control what is displayed on the page, and you can in some situations read out data that is shown as well (which is an issue in itself, and which may in turn enable more serious attacks such as CSRF).
    – tim
    Mar 22, 2017 at 20:07
  • Agreed you could do more than log who visits a page.
    – brirus
    Mar 22, 2017 at 20:22
  • Great answers, would like to add: Defamation of a website can have a serious impact on any organisation. Say I set an IS background image with propaganda or something? (I am not a CSS expert)
    – Wealot
    Mar 23, 2017 at 7:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.