PortSwigger Research Details CSS Injection Token Exfiltration via Overlapping Fragments

PortSwigger Research has published a new technical report detailing a method for CSS injection token exfiltration that bypasses standard length limits. The technique, which relies on overlapping fragments, was shared publicly on the r/netsec subreddit on Tuesday, according to the submission by user /u/theomkamble. This development highlights a persistent challenge in web security where traditional mitigation strategies may fail against sophisticated data extraction methods.

The core innovation described in the report involves splitting sensitive data into overlapping fragments before exfiltration. Standard CSS injection attacks often face limitations regarding the maximum length of tokens or strings that can be processed or observed by an attacker. By using overlapping fragments, an attacker can reconstruct the full data string even if individual parts are truncated or limited by the application’s security controls. This method effectively "smashes" the token limit, allowing for the complete retrieval of sensitive information such as authentication tokens or API keys.

Technical Context and Background

CSS injection attacks have long been a concern for web application security professionals. These attacks typically involve injecting malicious CSS rules into a vulnerable application, which then execute in the context of the victim’s browser. The injected CSS can be designed to send data back to an attacker-controlled server, often by leveraging the `@import` rule or background image requests. However, these methods are frequently constrained by the length of the URL or the specific data field being targeted.

The overlapping fragment technique addresses this constraint by ensuring that no single request needs to carry the entire payload. Instead, the data is broken down, and each fragment is sent in a way that overlaps with adjacent fragments. This redundancy allows the attacker to piece together the original data on their end, even if the receiving application or the network layer truncates parts of the transmission. According to the summary provided on r/netsec, this approach represents a significant evolution in how attackers can manipulate CSS for data exfiltration.

Who Is Affected

Web applications that rely on CSS parsing and are vulnerable to injection attacks are primarily at risk. This includes any platform where user-supplied input is rendered as CSS without proper sanitization or escaping. Applications that store sensitive tokens, such as session identifiers or API keys, in DOM elements that can be targeted by CSS selectors are particularly vulnerable. The impact is not limited to a specific vendor or product but rather to the architectural pattern of handling CSS input.

Security teams responsible for web application firewalls (WAFs) and input validation rules may also be affected. Existing signatures or detection mechanisms that look for standard CSS injection patterns may not catch this overlapping fragment technique. The subtlety of the attack means that it could bypass basic length checks or content filters that assume a single, contiguous block of data is being exfiltrated. Organizations must review their CSS handling policies to ensure they are not inadvertently facilitating this type of data leakage.

What should you do?

Security professionals should audit their web applications for any instances where user input is rendered as CSS. This includes checking for vulnerabilities in comment sections, profile customization fields, or any feature that allows style customization. It is crucial to ensure that all user-supplied CSS is properly sanitized or that CSS injection is prevented entirely by using allowlists for permissible styles.

Organizations should also review their logging and monitoring systems to detect unusual patterns in CSS-related network requests. While the overlapping fragment technique may not be immediately obvious, a high volume of small, repetitive requests from a single user agent could indicate an exfiltration attempt. Until vendors provide specific updates or patches for this vulnerability, defensive measures should focus on strict input validation and output encoding.

Background: Output encoding

Map every data flow to its specific output context, such as HTML bodies or JSON payloads. Apply the corresponding encoder that escapes dangerous characters for that specific sink. Verify the encoding at the application layer before the data reaches the browser to ensure the payload remains inert.

Read the full guide: Output Encoding Implementation: Step-by-Step Defense Against Injection

What to do and how to stay safe: PortSwigger

• Audit web applications for any fields that accept user-supplied CSS and ensure they are properly sanitized or blocked.
• Implement strict output encoding for any data rendered in the DOM that could be targeted by CSS selectors.
• Monitor network logs for unusual patterns of small, repetitive requests that may indicate data exfiltration via CSS.
• Review existing Web Application Firewall rules to ensure they can detect non-standard CSS injection attempts.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main vulnerability described in the PortSwigger Research report?

The report describes a CSS injection technique that uses overlapping fragments to bypass token length limits for data exfiltration.

How does the overlapping fragment technique work?

It splits sensitive data into overlapping parts, allowing attackers to reconstruct the full data even if individual parts are truncated by security controls.

Who published this research and where was it shared?

PortSwigger Research published the technique, and it was shared on the r/netsec subreddit by user /u/theomkamble.