Relative Path Overwrite (RPO) is a recent technique to inject style directives into sites even when no style sink or markup injection vulnerability is present. It exploits differences in how browsers and web servers interpret relative paths (i.e., path confusion) to make a HTML page reference itself as a stylesheet; a simple text injection vulnerability along with browsers’ leniency in parsing CSS resources results in an attacker’s ability to inject style directives that will be interpreted by the browser. Even though style injection may appear less serious a threat than script injection, it has been shown that it enables a range of attacks, including secret exfiltration. In this paper, we present the first large-scale study of the Web to measure the prevalence and significance of style injection using RPO. Our work shows that around 9 % of the sites in the Alexa Top 10,000 contain at least one vulnerable page, out of which more than one third can be exploited. We analyze in detail various impediments to successful exploitation, and make recommendations for remediation. In contrast to script injection, relatively simple countermeasures exist to mitigate style injection. However, there appears to be little awareness of this attack vector as evidenced by a range of popular Content Management Systems (CMSes) that we found to be exploitable.

Large-Scale Analysis of Style Injection by Relative Path Overwrite / Sajjad, Arshad; Mirheidari, Seyed Ali; Tobias, Lauinger; Crispo, Bruno; Engin, Kirda; Robertson, William K.. - (2018), pp. 237-246. (Intervento presentato al convegno WWW '18: The Web Conference 2018 tenutosi a Lyon, France nel 23-27 April, 2018) [10.1145/3178876.3186090].

Large-Scale Analysis of Style Injection by Relative Path Overwrite

Mirheidari, Seyed Ali;Bruno Crispo;
2018-01-01

Abstract

Relative Path Overwrite (RPO) is a recent technique to inject style directives into sites even when no style sink or markup injection vulnerability is present. It exploits differences in how browsers and web servers interpret relative paths (i.e., path confusion) to make a HTML page reference itself as a stylesheet; a simple text injection vulnerability along with browsers’ leniency in parsing CSS resources results in an attacker’s ability to inject style directives that will be interpreted by the browser. Even though style injection may appear less serious a threat than script injection, it has been shown that it enables a range of attacks, including secret exfiltration. In this paper, we present the first large-scale study of the Web to measure the prevalence and significance of style injection using RPO. Our work shows that around 9 % of the sites in the Alexa Top 10,000 contain at least one vulnerable page, out of which more than one third can be exploited. We analyze in detail various impediments to successful exploitation, and make recommendations for remediation. In contrast to script injection, relatively simple countermeasures exist to mitigate style injection. However, there appears to be little awareness of this attack vector as evidenced by a range of popular Content Management Systems (CMSes) that we found to be exploitable.
2018
Proceedings of the 2018 World Wide Web Conference on World Wide Web, WWW 2018
NYC
ACM
978-1-4503-5639-8
Sajjad, Arshad; Mirheidari, Seyed Ali; Tobias, Lauinger; Crispo, Bruno; Engin, Kirda; Robertson, William K.
Large-Scale Analysis of Style Injection by Relative Path Overwrite / Sajjad, Arshad; Mirheidari, Seyed Ali; Tobias, Lauinger; Crispo, Bruno; Engin, Kirda; Robertson, William K.. - (2018), pp. 237-246. (Intervento presentato al convegno WWW '18: The Web Conference 2018 tenutosi a Lyon, France nel 23-27 April, 2018) [10.1145/3178876.3186090].
File in questo prodotto:
File Dimensione Formato  
www2018rpo(1).pdf

accesso aperto

Tipologia: Post-print referato (Refereed author’s manuscript)
Licenza: Creative commons
Dimensione 624.6 kB
Formato Adobe PDF
624.6 kB Adobe PDF Visualizza/Apri
3178876.3186090.pdf

accesso aperto

Tipologia: Versione editoriale (Publisher’s layout)
Licenza: Creative commons
Dimensione 1.16 MB
Formato Adobe PDF
1.16 MB Adobe PDF Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11572/228523
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 6
  • ???jsp.display-item.citation.isi??? 4
social impact