sites triggering this extension

[jawz101]

I don't know of any sites that trigger this extension so I figured maybe there should be a post about it.

[mlgualtieri]

Well, there's obviously the vulnerability tester: https://www.mike-gualtieri.com/css-exfil-vulnerability-tester

But, I haven't personally encountered any sites with embedded malicious CSS. A while back the Zappos site used to trigger the plugin as they were filling in their star ratings exactly in the way that can be abused by the attack, but they have since changed these CSS rules. (Note: Zappos wasn't hacked, the way they were targeting selectors was the same as how the attack works, which is valid CSS.)

I have seen two bug bounties paid out that abused CSS Exfil to retrieve CSRF tokens, so kudos to those researchers.

But yes, if anyone does find a live example in the wild feel free to share it here. This is also a good bug for anyone to supply sites that trigger a false positive.

[nobody43]

https://arstechnica.com/

[mlgualtieri]

Someone has mentioned this before, but I've never been able to replicate. Just visited Ars right now and no rules are flagged by the plugin in my browser.

[jawz101]

I think if the add-on had an option to send those url's to someone that causes it to trigger I would leave that option checked. This is such a set & forget add-on and I pin it to my overflow menu so I'll never actually notice if it ever get triggered.

[mlgualtieri]

It's suppose to be set and forget, so it's working :-) At this point most of the bugs and edge cases have been (hopefully) figured out, so it sits back and sanitizes things.

I've thought about adding a reporting option before, so maybe. Right now it doesn't send any data anywhere (as per the privacy policy I recently added).

[nobody43]

https://s.put.re/g6Vrabqq.png
https://s.put.re/vaW66dn8.png

[mlgualtieri]

Any chance you can grab the offending stylesheet and post it here? Or, provide a direct URL? We must be seeing different stylesheets.

[nobody43]

Have no idea what to look for.
https://gist.github.com/nobodysu/93934adb34a7e9f4c62fbc01c27f20f7
Any directions?

[mlgualtieri]

Thanks! This was the relevant line:
<link rel="stylesheet" type="text/css" media="all" href="https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-af0123dfd5.css" />
But, that's the same stylesheet I'm being served and nothing triggers for me. I looked through the styles too and nothing looks like it should be triggering the rules. Are you perhaps singed in to the site? Maybe it's an artifact from another plugin?

[nobody43]

I'm not signed in. Perhaps it's from extensions, but I don't know how to troubleshoot it.
https://s.put.re/mJ2v2sLN.png

[mlgualtieri]

Oh! I was writing a reply and just realized I was only checking on Chrome. The plugin triggers on Firefox! OK. I have something to debug against now.

[nobody43]

Another one on firefox:
https://www.kinopoisk.ru/photos/

[nobody43]

https://support.lenovo.com/us/en/

[mlgualtieri]

I finally was able to track down the reasons for the false positives on the reported URLs:
https://arstechnica.com/
https://www.kinopoisk.ru/photos/
https://support.lenovo.com/us/en/

These will be fixed in the upcoming 1.0.18 release.