60SecondsInAfrica's blog

Codeforces Parsing CSS -> Potential security issue?
By 60SecondsInAfrica, history, 4 years ago, In English

Dear Codeforces community. recently, kostia244 found out that codeforces parses custom CSS & HTML in this comment: https://mirror.codeforces.com/blog/entry/82468?#comment-693536

This could potentially be exploited by putting a malicious URL to steal a user's cookies and login sessions. Obviously making a PoC would be illegal but I would like to discuss whether or not that's even possible, and if so notify the admins to fix.

This is could be dangerous, this text is not even a part of the image

https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense

  • Vote: I like it
  • +115
  • Vote: I do not like it

»
4 years ago, # |
  Vote: I like it +92 Vote: I do not like it

I don't see any way this could be abused.

→ Reply
»
4 years ago, # |
  Vote: I like it +62 Vote: I do not like it
test
→ Reply
»
4 years ago, # |
  Vote: I like it +24 Vote: I do not like it

none of the xss attacks I tried worked, but you can still do some funny shit
a trick to get stuff outside of the comment box is to wrap an outer element around something that has shitloads of margin

bruh moment

→ Reply
»
4 years ago, # |
← Rev. 4   Vote: I like it +29 Vote: I do not like it

→ Reply
»
4 years ago, # |
← Rev. 5   Vote: I like it +4 Vote: I do not like it

→ Reply