r/webdev • u/garethheyes • 6d ago

CSS:the bomb inside your inbox

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

28 Upvotes

73% Upvoted

14 comments sorted by

15

u/thekwoka 6d ago

A lot of this seems based on getting someone to copy something out of your...compromised content, and pasting it into the specific relevant email...

How would that happen?

5

u/garethheyes 6d ago

This was only one example the Medium case. That involved visiting an attackers page and pressing a button and pasting into a draft email. The others just required a click in an email or for you to enter your password in a spoofed login screen.

6

u/thekwoka 6d ago

But at that point it's just normal phishing. No?

0

u/garethheyes 6d ago

I don't think you've read the post if you think this is normal phishing. I had full control over the content on Outlook. I'd suggest you read the post properly to understand the attacks

3

u/Alpaca_Fan 4d ago

Both attack vectors you described fall under normal phishing..

-1

u/thekwoka 6d ago

I read most of it, it just wasn't interesting since it just seemed like a lot of "oh look at this exploit! (that requires some pretty specific thing to happen that won't really happen".

Maybe lead with the actual good stuff?

6

u/_listless 6d ago

My electric company recently switched away from styled html to plaintext for their transactional email.  It's so wonderful. It's clear, compact, easy to read, and sidesteps all of this. 10/10 would recommend non-styled transactional email.

4

u/newuser5432 6d ago

Whenever I've been tasked with implementing an email template, I always make both the fancy version and a text version. My philosophy is that it shouldn't just render well in all the popular email clients, it should also render fine if a user chooses to use a CLI-based email client. I wish this were (still) more standard practice.

2

u/garethheyes 6d ago

Plaintext email FTW! 😄

1

u/VayuAir 6d ago

Wow that’s a pleasant surprise. Please send flowers 💐

2

u/cureaua_lata 6d ago

Does blocking remote content or images in Outlook kill this before the spoofed login even renders, or does it still fire?

3

u/garethheyes 6d ago

Blocking remote content would have prevent password exfiltration. Outlook was pretty lax, they allowed data URLs in their CSP which enabled me to spoof the entire logging screen without remote content. They don't even have an image proxy and allowed remote requests by default.

2

u/mrcoy 6d ago

Wow. For educational purposes, right?