Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Summary

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply.

Details

While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the previously consumed code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following ) was incorrectly treated as escaped and the bad URL token continued until the next unescaped ) or the end of the input.

Browsers terminate the bad URL at that ), so everything Crass treated as part of the bad URL is live CSS to a browser.

This bug has existed in every released version of Crass.

Impact

Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output):

• Sanitize (all versions through 7.0.0):
  • In Sanitize::CSS.properties and style attributes, a bad URL inside a [...] or (...) block in the value of an allowlisted property can smuggle arbitrary declarations, such as position: fixed or a background-image URL with a disallowed protocol.
  • In Sanitize::CSS.stylesheet and <style> elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including @import.
• Loofah (Loofah::HTML5::Scrub.scrub_css, used for style attributes), and therefore rails-html-sanitizer (sanitize_css, and sanitize when style is a permitted attribute): a bad URL inside an allowlisted function such as calc() or rgb() can smuggle declarations Loofah normally strips, such as position: fixed and url() values.

Smuggled CSS can be used for UI redress (clickjacking or phishing overlays), loading attacker-controlled external resources, and, where rules or @import can be smuggled, CSS-based data exfiltration. This vulnerability doesn't allow script execution in modern browsers.

Patches

Fixed in Crass 1.0.8. Users of Sanitize, Loofah, rails-html-sanitizer, or any other library that uses Crass to sanitize CSS should upgrade Crass to 1.0.8 or later.

Workarounds

There are no practical workarounds other than upgrading. Rejecting any CSS input that contains the character sequence \\ would block the known trigger, but this is a blunt measure and may reject legitimate CSS.

References

• CSS Syntax Module Level 3, "Consume the remnants of a bad url": https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url