CSS Exfiltration

There is my writeup for a task on css injection attack.

The website provide an feedback function for report a bug to admin. After sending test information, we can see that form sent to admin.

If we look on responce at burp suite

We can see intersting css function @importurl

With this function we can parse .css files, can we replace this file?

We have full control over the @importurl source and can upload our own css files. Based on this, our next step is to try to reproduce css injection.

In the picture above you can see a basic css injection based on loading a background and stealing one/the first character in the victim's token sent to our controlled webhook.

So the concept of the attack is to force the victim to download our "infected" .css file, which will steal his first token. We could use a regular webhook tool for this, but since the server automatically adds .css at the end.

We should use our own personal server which will locate css payload on endpoint, /somename.css, you can use ngrok or your personal vps to host your payload.

Before sending the payload to the admin, we should check the payload on ourselves. Since we know our token, we will steal its first symbol to check the correct operation.

First char is y, and payload is:

The payload is located on /bro.css endpoint, so we can check it.

After sending we got request on our webhook

We successfully performed css injection and "stole" the first character of our token.

Stealing character by character is a long operation, since usually a csrf token stores 32 characters, so I remembered that a few days ago a security researcher slonser, published an interesting post about a new way of the css injection attack, using the attr() function.

The thing is that starting with Chrome 133, the attr() function allows you to work with variables

Now variable --val contains csrf-token but previous type of hooking background: url(var(--val));will be incorrect, but if we using background: image-set(var(--val)); thats work!

For more details you can look at the official research.

Based on this we can try to exploit and grab full csrf-token of victim by only 1 request.

And test it firstly on our side

Awesome! it works, we stole the whole csrf token in one request. It's time to test our exploit on the admin

But after some time and a bunch of attempts, this was not successful, I could not steal the token until I realized that the admin bot uses chromium 120v

Which means that it won't work on the admin! So at this stage we will return to the oldschool css injection attack, to steal the token character by character. All we need to do is repeat our first attack and extract the files, I used a small script for the slightest automation

Using a painstaking process, we extract all the characters of the csrf token.

After extracting full csrf token , do request as admin and get the flag!