Home > CAPEC List > CAPEC-468: Generic Cross-Browser Cross-Domain Theft (Version 2.11)  

CAPEC-468: Generic Cross-Browser Cross-Domain Theft

Generic Cross-Browser Cross-Domain Theft
Definition in a New Window Definition in a New Window
Attack Pattern ID: 468
Abstraction: Standard
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser

By having control of some text in the victim's domain, the attacker is able to inject a seemingly valid CSS string. It does not matter if this CSS string is preceded by other data. The CSS parser will still locate the CSS string.

If the attacker is able to control two injection points, one before the cross domain data that the attacker is interested in receiving and the other one after, the attacker can use this attack to steal all of the data in between these two CSS injection points when referencing the injected CSS while performing rendering on the site that the attacker controls. When rendering, the CSS parser will detect the valid CSS string to parse and ignore the data that "does not make sense". That data will simply be rendered. That data is in fact the data that the attacker just stole cross domain.

The stolen data may contain sensitive information, such CSRF protection tokens.

+ Attack Prerequisites
  • No new lines can be present in the injected CSS string

    Proper HTML or URL escaping of the " and ' characters is not present

    The attacker has control of two injection points: pre-string and post-string

+ Typical Severity


+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: High

Ability to craft a CSS injection

+ Resources Required

Attacker controlled site/page to render a page referencing the injected CSS string

+ Solutions and Mitigations

Design: Prior to performing CSS parsing, require the CSS to start with well-formed CSS when it is a cross-domain load and the MIME type is broken. This is a browser level fix.

Implementation: Perform proper HTML encoding and URL escaping

+ References
[R.468.1] Chris Evans. "Generic cross-browser cross-domain theft". December 28, 2009. <http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html>.
+ Content History
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
CAPEC Content TeamThe MITRE Corporation2015-11-09Updated Related_Attack_PatternsInternal
CAPEC Content TeamThe MITRE Corporation2015-12-07Updated Related_Attack_PatternsInternal

More information is available — Please select a different filter.
Page Last Updated or Reviewed: August 04, 2017