I think many people are familiar with the topic of blind CSS exfiltration, especially after the post by @garethheyes However, an important update has occurred since then, which I wrote below ->
Usually, when we talk about exfiltration using CSS, we talk about using selectors, and it looks something like this:
But starting this year, changes have been made to Chromium — the CSS attr() function can now store attribute values in CSS custom properties (pseudo-variables). https://developer.chrome.com/b...
Therefore, we can store the value of any attribute in a CSS custom property. However, we can't use the value of a pseudo-attribute in url(). And this is where image-set comes to the rescue — it allows us to use properties as arguments. https://developer.mozilla.org/...
All that's left for you to do after this is to import a stylesheet from your own site with such content — and you’ll be able to steal the attribute value with a single request, instead of brute-forcing like before. (URL will take the base from the stylesheet's domain)
@slonser_ @garethheyes I'm reading the spec it seems that this exfiltration shouldn't be possible. Might be worth filling a bug for it: #attr-security class="text-blue-500 hover:underline" target="_blank" rel="noopener noreferrer">https://drafts.csswg.org/css-v...
@terjanq @garethheyes Oh, that's funny. I didn't even think about it, I just saw that it was finally possible to save to property, and the trick with image-src, this is how it always worked. I think I'll fill in the bug, but of course I wonder how it can be fixed.