There is a CSS injection vulnerability in the ad blocking extension 'uBlock Origin' that steals user passwords
The ad blocking feature to hide ads on your website prevents your PC from being compromised by malicious ads. However, it was reported that the ad blocking extension ' uBlock Origin ' had a vulnerability that could steal the information entered by the user on the website by exploiting the mechanism to block ads.
uBlock, I exfiltrate: exploiting ad blockers with CSS | PortSwigger Research
The ad blocking extension that hides ads that appear on your website uses a community-provided 'filter list' to decide whether to accept or block web resources. And this filter list mainly consists of two types of rules: 'network rules' that explain URLs that should be blocked and 'cosmetic rules' that explain page elements (CSS / stylesheets) that should be hidden. I will . For example, the network rule says 'block communication with ad.com', and the cosmetic rule says 'hide [div id =' ad '] [/ div] in the page'. Filter lists are important for ad blocking, but they can also serve malicious lists.
On August 25, 2021, Tavis Ormandy reported that the ad blocking extension 'uBlock Origin' was vulnerable to CSS injection.
CSS injection literally inserts code into the CSS used by your website. Websites where code can be inserted by a malicious third party can be tampered with by obscuring existing HTML elements or creating new pseudo-elements. As mentioned above, ad blocking uses CSS, and by using the CSS injection vulnerability that exists in uBlock Origin, it is possible to manipulate the display of various websites that users browse. In fact, Ormandy is demonstrating the display of the Google logo on the sample URL.
Here's a dumb one I just found ???? (I've already filed a bug). Pic.twitter.com/LApsCMDvir— Tavis Ormandy (@taviso) August 25, 2021
On the day Ormandy pointed out, uBlock Origin distributed the patch, which once fixed the problem, but on November 3rd, it became clear how the patch could be bypassed. Security researcher Gareth Hayes tested it with CSS fuzzing and found that it was possible to extract data from a website with multiple CSS injections.
You can check the details of the attack from the following.
GitHub --PortSwigger / css-exfiltration
uBlock Origin provides a powerful filter for ads, preventing your computer from being compromised by malicious attacks. On the other hand, Hayes cautioned that it is vulnerable to CSS injection and could steal information from any website or web page if a user loads a malicious filter. .. In response to Mr. Hayes's report, uBlock Origin immediately distributed the patch, released the stable version on November 22, updated the Firefox version, and updated the Chrome version on December 3.
in Security, Posted by logq_fa