We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:


Current browse context:


Change to browse by:


References & Citations

DBLP - CS Bibliography


(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: Large-Scale Analysis of Style Injection by Relative Path Overwrite

Abstract: Relative Path Overwrite (RPO) is a recent technique to inject style directives into sites even when no style sink or markup injection vulnerability is present. It exploits differences in how browsers and web servers interpret relative paths (i.e., path confusion) to make a HTML page reference itself as a stylesheet; a simple text injection vulnerability along with browsers' leniency in parsing CSS resources results in an attacker's ability to inject style directives that will be interpreted by the browser. Even though style injection may appear less serious a threat than script injection, it has been shown that it enables a range of attacks, including secret exfiltration.
In this paper, we present the first large-scale study of the Web to measure the prevalence and significance of style injection using RPO. Our work shows that around 9% of the sites in the Alexa Top 10,000 contain at least one vulnerable page, out of which more than one third can be exploited. We analyze in detail various impediments to successful exploitation, and make recommendations for remediation. In contrast to script injection, relatively simple countermeasures exist to mitigate style injection. However, there appears to be little awareness of this attack vector as evidenced by a range of popular Content Management Systems (CMSes) that we found to be exploitable.
Comments: The Web Conference (WWW), Lyon, France, April 2018
Subjects: Cryptography and Security (cs.CR)
DOI: 10.1145/3178876.3186090
Cite as: arXiv:1811.00917 [cs.CR]
  (or arXiv:1811.00917v2 [cs.CR] for this version)

Submission history

From: Sajjad Arshad [view email]
[v1] Fri, 2 Nov 2018 15:09:58 GMT (654kb,D)
[v2] Fri, 14 Feb 2020 00:07:22 GMT (326kb,D)

Link back to: arXiv, form interface, contact.