The Story of CSS, JavaScript, and RPO (Relative Path Overwrite)

Sit down kids I’m gonna tell you a story. CSS once had JavaScript. You could actually embed it within the property value. An equal measure of people thought this was great and horrific. Another interesting fact IE also supported “=” as a property-value separator.

I also invented a technique called RPO that could hijack relative stylesheets and execute JavaScript. This means you could use a single forward slash in the URL to turn a relative stylesheet to embed the current page as CSS. What people don’t realise is…

I actually discovered RPO many years before I blogged it. So IE was still in widespread use at the time :D. Anyway, I hope you enjoyed story time. I’ll leave you with an XSS vector that used to work in IE:

`

`

You Should Know:

1. RPO (Relative Path Overwrite):

• RPO is a technique that exploits how browsers handle relative paths in CSS files. By manipulating URLs, an attacker can force a browser to interpret a page as a CSS file, leading to potential JavaScript execution.
• Example: If a site uses a relative path like ../styles.css, an attacker can manipulate the URL to load the current page as a CSS file, potentially executing malicious scripts.

2. CSS and JavaScript in IE:

• Internet Explorer (IE) once allowed JavaScript to be embedded directly within CSS properties using the `expression()` function.
• Example: `
  ` would execute JavaScript in older versions of IE.

3. XSS Vector in IE:

• The provided XSS vector `

  ` demonstrates how IE’s support for `expression()` could be exploited to execute arbitrary JavaScript.

4. Modern Mitigations:

• Modern browsers have deprecated and removed support for `expression()` in CSS.
• Use Content Security Policy (CSP) to restrict inline scripts and unsafe evaluations. Example CSP header:

  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self';
  

5. Testing for RPO Vulnerabilities:

• Use tools like Burp Suite or OWASP ZAP to manipulate URLs and test for RPO vulnerabilities.
• Example command to test URL manipulation:

  curl -I http://example.com/path/to/resource/../malicious.css
  

6. Secure Coding Practices:

• Always use absolute paths for CSS and JavaScript files to prevent RPO attacks.
• Example: Use `/static/styles.css` instead of ../styles.css.

What Undercode Say:

The story of CSS, JavaScript, and RPO highlights the evolution of web security and the importance of understanding historical vulnerabilities. While modern browsers have mitigated many of these risks, legacy systems and outdated practices can still pose threats. Always ensure secure coding practices, such as using absolute paths, implementing CSP, and regularly testing for vulnerabilities.

For further reading on RPO and CSS vulnerabilities, check out these resources:
– PortSwigger: Relative Path Overwrite
– OWASP: Cross-Site Scripting (XSS)
– MDN Web Docs: Content Security Policy (CSP)

Commands and Tools to Practice:

• Use `curl` to test URL manipulation:

  curl -I http://example.com/path/to/resource/../malicious.css
  

• Test CSP headers with:

  curl -I http://example.com | grep -i content-security-policy
  

• Use Burp Suite to intercept and manipulate HTTP requests for RPO testing.

Stay vigilant and keep your systems secure!

References:

Reported By: Gareth Heyes – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram