9

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this way.

Can they do XSS using just the style attribute value in modern browsers?
With 'modern' being IE10+ and newest versions of other browsers.

  • You need to provide us with more details about your implementation. Here is a way to exec js using css only stackoverflow.com/questions/476276/using-javascript-in-css - note: This might not work on moderns browsers – AK_ Jun 10 '14 at 11:27
  • The implementation itself might have other flaws, but to focus my question I am only looking at any XSS problems with style="literally anything valid in an attribute value, as long as it does not break out of an attribute value". – Andrey Shchekin Jun 10 '14 at 11:42
  • @AK_ also I've seen those posts, but those seem to talk about older browsers -- I am interested in modern ones. – Andrey Shchekin Jun 10 '14 at 11:44
  • I know this question is old, but can we get an update of our definition of what "modern" is? Not that browser version should matter as if you have to consider older browsers, it is still a vulnerability but would be awesome to get an update. – aug Aug 29 '17 at 18:56
4

I have searched for it everywhere, but I think all modern browsers are safe from XSS into CSS. Although I had one particular test and it got executed into my Chrome (and probably other browsers)

If you application is naively injecting any input into <style>...</style> this interesting scenario can happen:

<html>
<head>
<style>
p {
    text-align: center;
    color: red;
    /*user can inject here*/
    }</style><script>alert()</script>

}
</style>
</head>
<body>

<h1>My First Heading</h1>

<p>My first paragraph.</p>

</body>
</html>

...

OR

p {
    /*injecting into bg's url*/
    background: url("garbage"}</style><script>alert()</script>/*) repeat;
    text-align: center;
    color: red;
} 

Obviously .. an XSS

enter image description here

3

Although dangerous tricks such as behavior: url('some.htc') aren't available in modern browsers by default, if you are using the X-UA-Compatible header or meta tag to force Microsoft Internet Explorer in a different render mode, or if you are omitting the document type declaration, Internet Explorer will use the behavior of older versions where such things are available.

A demonstration (note: I can't get this to work on IE 11): http://jsbin.com/siyuhika/1/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.