Large-Scale Analysis of Style Injection by Relative Path Overwrite.

摘要: Relative Path Overwrite (RPO) is a recent technique to inject style directives into sites even when no sink or markup injection vulnerability present. It exploits differences in how browsers and web servers interpret relative paths (i.e., path confusion) make HTML page reference itself as stylesheet; simple text along with browsers' leniency parsing CSS resources results an attacker's ability that will be interpreted by the browser. Even though may appear less serious threat than script injection, it has been shown enables range of attacks, including secret exfiltration. In this paper, we present first large-scale study Web measure prevalence significance using RPO. Our work shows around 9% Alexa Top 10,000 contain at least one vulnerable page, out which more third can exploited. We analyze detail various impediments successful exploitation, recommendations for remediation. In contrast relatively countermeasures exist mitigate injection. However, there appears little awareness attack vector evidenced popular Content Management Systems (CMSes) found exploitable.