0

I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:

https//www.****.**.*/content/css/app.css

Which generated the below output:

/* Minification failed. Returning unminified contents.
(856,107): run-time error CSS1036: Expected expression, found '}'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1062: Expected semicolon or closing curly-brace, found '.'
(2353,12): run-time error CSS1038: Expected hex color, found '#fff9'
(2353,17): run-time error CSS1062: Expected semicolon or closing curly-brace, found ' '
 */
/*!
 * Bootstrap v3.3.7 (http://getbootstrap.com)
 * Copyright 2011-2016 Twitter, Inc.
 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)etc.......

The app.css should be accessible knowing that content and css directories are forbidden from server side.

The Question I am searching an answer for:

Does App.Css pose any security threat or issue from information disclosure perspective or can it be considered a vulnerability while published or is it a normal behavior ?

1

It's a bit unusual to publish a CSS file which the minify process failed on, and may be indicative of other issues (e.g. insufficient monitoring of the deployment process), but CSS files are used by end user browsers, so the content shouldn't be sensitive. At most, it might include styles which are applied to pages or controls which the current user doesn't have access to, but applications should not rely on styling for access control, so this should not cause problems in a sensibly designed application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.