the-web-application-hackers-handbook

518 Chapter 13 n Attacking Users: Other Techniques
For example, in a web mail application, an attacker may be able to introduce
some limited text into the response of a target user via the subject line of an
e-mail. In this situation, the attacker may be able to capture sensitive data crossdomain
by injecting CSS code into the application.
In the example already discussed, suppose the attacker sends an e-mail with
this subject line:
{}*{font-family:’
Since this does not contain any HTML metacharacters, it will be accepted
by most applications and displayed unmodified in responses to the recipient
user. When this happens, the response returned to the user might look
like this:
WahhMail Inbox
...
{}*{font-family:’
...
...
...
var _StatsTrackerId=’AAE78F27CB3210D’;
...
This response obviously contains HTML. Surprisingly, however, some browsers
allow this response to be loaded as a CSS stylesheet and happily process any
CSS definitions it contains. In the present case, the injected response defines the
CSS font-family property and starts a quoted string as the property definition.
The attacker’s injected text does not close the string, so it continues through the
rest of the response, including the hidden form field containing the sensitive
anti-CSRF token. (Note that it is not necessary for CSS definitions to be quoted.
However, if they are not, they terminate at the next semicolon character, which
may occur before the sensitive data that the attacker wants to capture.)
To exploit this behavior, an attacker needs to host a page on his own domain
that includes the injected response as a CSS stylesheet. This causes any embedded
CSS definitions to be applied within the attacker’s own page. These can