当我们浏览互联网时，我们会面临许多漏洞，这些漏洞可能会将我们的数据暴露给攻击者。但随着时间的推移，为了保护我们免受这些攻击，技术已经发展。但与此同时，攻击者不断尝试寻找漏洞并侵入我们的系统。我们今天要讲的漏洞在于网页的CSS，它被称为CSS Exfil。

现代^(Modern)网站严重依赖CSS进行样式设置，您无法想象没有CSS的网站。CSS Exfil可用于使用级联样式表^{(Cascading Style Sheets)}( CSS ) 作为攻击媒介来窃取目标数据。它会使您的用户名、密码、电子邮件等信息处于危险之中。有多种攻击场景依赖于CSS Exfil。它们包括代码注入、网络跟踪、非法广告、 DOM^(DOM)中的恶意代码放置等等。

必须针对此漏洞进行保护，但我们使用的大多数现代浏览器都没有针对此漏洞的保护措施。

如何检查您的浏览器是否容易受到CSS Exfil攻击

这里有一个很棒的CSS Exfil Vulnerability Tester ， 可以^{(available here)}在任何浏览器上工作并确认保护状态。该工具测试浏览器的同源和跨域CSS。该网页将尝试通过CSS Exfil模拟攻击，并产生成功的结果。

^{(CSS Exfil Protection Extension)}适用于Chrome和Firefox的^(Firefox)CSS Exfil 保护扩展

如果您的浏览器被证明是易受攻击的，那么您应该考虑为其添加一点安全性。Chrome和Firefox都有一个扩展程序可以为您完成这项工作。该扩展名为CSS Exfil Protection，也可以从Chrome Web Store和Firefox Store下载。

安装并启用后，您可以再次前往漏洞测试器检查您的浏览器是否受到保护。攻击图像不应该加载，所有测试都应该产生积极的结果。

此外，您将能够注意到地址栏旁边带有扩展程序图标的计数。该计数表明该网页试图利用漏洞并已被阻止。因此，如果您在使用的其他网站上注意到此计数，则需要小心这些网站。

CSS Exfil Protection扩展通过预处理网页的CSS来工作。^(CSS)它扫描整个CSS并在^(CSS)CSS属性值中查找任何远程调用。如果存在任何这样的远程调用，它将中和它并使CSS干净。并且计数可能是它在该网页的CSS中找到的此类远程调用的数量。^(CSS)

CSS Exfil可以创建相当多的漏洞。必须对它们进行保护。这个扩展只是朝着正确方向迈出的一步，我们希望在未来看到浏览器原生提供更多的安全性。CSS Exfil Protection是开源的，可以免费下载。您可以查看其GitHub页面或直接从 Web 浏览器的扩展商店下载。

CSS Exfil Protection browser extension offers CSS Exfil vulnerability attack

As we are browsing the intеrnеt, we are expoѕed to a lot of vulnerabilities that might exposе our data to attackers. But with time, the technology has evolvеd in ordеr to protect us against thеse attacks. But at the same time, the attackers and constantly trying to find vulnerabilities and hack into оur systems. The vulnerability that we arе talking about today lies in CЅS of a webрagе and it is called CSS Exfil.

Modern websites rely heavily on CSS for styling and there is no way you can imagine a website without CSS. CSS Exfil can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. It puts your information such as username, passwords, emails at risk. There are a variety of attack scenarios that rely on CSS Exfil. They include code injection, web tracking, illegitimate advertisements, malicious code placement in DOM and a few more.

Protection against this vulnerability is must but most of the modern browsers that we use do not come with protection measures against this vulnerability.

How to check if your browser is vulnerable to CSS Exfil attacks

There is a wonderful CSS Exfil Vulnerability Tester available here that can work on any browser and confirm the protection status. The tool tests a browser for the same origin and cross-domain CSS. The webpage would try to mimic the attack via CSS Exfil and will produce the results it was successful.

CSS Exfil Protection Extension for Chrome and Firefox

If your browser turns out to be vulnerable, then you should consider adding a little security to it. There is an extension available for both Chrome and Firefox that does this job for you. The extension is called CSS Exfil Protection and is available to download from Chrome Web Store and Firefox Store as well.

Once installed and enabled, you can head over to the vulnerability tester again to check if your browser is protected or not. The attack images should not load, and all the tests should produce a positive result.

Also, you will be able to notice a count with the extension’s icon beside the address bar. The count is the indication that this webpage tried to exploit a vulnerability and it has been blocked. So, if you notice this count on other websites that you use, you need to be careful around those websites.

CSS Exfil Protection extension works by pre-processing the CSS of a webpage. It scans the entire CSS and looks for any remote calls inside CSS attribute values. If any such remote call exists, it neutralizes it and makes the CSS clean. And the count is probably the number of such remote calls it found in the CSS of this webpage.

CSS Exfil can create quite a lot of vulnerabilities. Having protection against them is a must. This extension is just one step in the right direction, and we hope to see more security offered by the browsers natively in the future. CSS Exfil Protection is open source and free to download. You can check out its GitHub page or directly download it from the extension store of your web browser.

Related posts

• 如何手动启用Windows 10 Retpoline

• 如何报告Bug，Issue or Vulnerability给Microsoft

• DLL Hijacking Vulnerability Attacks，Prevention & Detection

• Bitdefender Home Scanner：扫描您的Home Network以进行漏洞

• SecPod Saner Personal：Free Advanced Vulnerability Scanner

• 什么是Windows 10中的Tamper Protection feature

• 打开Potentially Unwanted Program Protection：GPO，Regedit，PowerShell

• Windows无法启动Software Protection service

• Windows Resource Protection发现了损坏的文件，但无法修复其中一些[已解决]

• Windows Information Protection（WIP）自动保护分类文件

• [已修复] Windows 资源保护无法执行请求的操作

• 什么是Google Advanced Protection Program？

• 通过教育实现网络安全：卡巴斯基交互式保护模拟

• 在 IE 11 和 Edge 中启用不跟踪和跟踪保护

• 如何禁用或启用Firefox Redirect Tracking Protection（ETP 2.0）

• Ransomware Attacks，Definition，Examples，Protection，Removal

• Set了Enhanced Tracking，Protection Breach Alerts，Lockwise在Firefox

• Lockwise，Monitor，Facebook Container，Tracking Protection上Firefox

• 如何设置OneDrive account的Folder Protection

• 什么是COVID Protection Google Exposure Notifications？