Github's CSS Injection Exploit Was Incredible!

Key Takeaways

over the weekend a bit of a problems discovered with how GitHub handles read me files letting you do things like this maybe you can't tell what's going on yet how about this yes it worked with gifts as well what about this one or you could be a little bit more reasonable and just make it like a Tumblr page this didn't just work on profile readms though it also worked on repo readms as well and you could even make it as obnoxious as this this has since been patched but before that all you needed to add was a line that looked like this this might look fairly complex but most of this is just CSS styling the actual minimal version of the exploit is very simple but we'll get more into how it works in just a bit now the CSS part there was very important because this is what is known as a CSS injection so we all know that through inspect element we can go and add custom CSS on our local side with a CSS injection you are changing it for every other user as well now it's unclear just how long this bug was present on GitHub because the joys of proprietary software development but we do know who originally spotted the bug they go by Cloud over on Twitter that was the first example I showed before and would you at'll be surprised to know that it's a weeb with a lucky star profile picture that spotted the bug because there seems to be a high correlation between being a weeb and being in the security industry now for reference when you spot a bug like this the correct thing to do is go to the platform report the bug give them some period until you disclose the bug and then report it publicly they didn't do this this is the first reporting of the bug and then just started posting about it oh husband you disclosed the vulnerability publicly now we don't have Bounty money and we'll be homeless now to be fair they did have an email discussion with GitHub and it was addressed within about 12 hours or so but they kind of did it in the wrong order allowing us to see things like this enough rambling what actually happened here well to put it simply a lack of proper user input sanitization which is always a recipe for disaster one of the first things I was told in university is assume that every single one of your users is malicious and everything they send you is in some way trying to break your system if something they can send you is going to affect other users or going to affect your system in a negative way make sure you check it make sure you sanitize it and make sure it is squeaky clean before you do anything with that data now GitHub like most websites out there relies on some open- Source libraries the one that we care about today is called math Jacks this is a really popular library for taking lch math ML and asky math notation and then converting it into something that can be displayed on a web page as we saw here this math bit this indicates that what we doing next is going to be something that math Jax needs to handle now the intended purpose of math Jacks is displaying things like mathematical equations but there was a bit of a problem with how it was passing this statement now the main part that we care about here is from this Unicode section onwards and this blog post here does a fantastic job at breaking down the problem also including a very very minimal example how to achieve the injection GitHub uses math Jacks to render math expressions presented in any GitHub markdown content such as read me files issue comments and po request comments yes it was also working in those as well and one of the many LC macros that math Jack support is called Unicode it allows the rendering of a Unicode character it also allows the font style of the character to be customized by letting the user pass in a custom font family like so so here we are saying draw this character here with this font turns out it is possible to inject any inline CSS within the square brackets so you can include the font family and then all of this other CSS the CSS is then injected to the style attribute of the mtex element that displays the Unicode character many have taken this opportunity to Rice up the GitHub profile Pages this will make a lot more if I show you the HTML so when we setting the font family here the only thing that is supposed to be getting set in the style option here is font family in this case to my font but it's naively taking everything in the square brackets and then just dumping it in the style setting so if you include a semicolon here which means the end of a statement you're basically breaking out of this setting right here and then including anything else you want so in this case all of this stuff and then you get something that looks more like this and then you can go even further because CSS styling let you set a background image now you can see the problem this blog post goes very deep into the code behind math Jacks that made all of this possible and I highly highly recommend you go and read it for yourself but since it is just walls and walls of text I'm going to jump ahead to the explanation let's go through the attack step by step step the code the back uni code treats anything in between the square brackets so all of this right here as the name of the font family and extracts that entire string as the value for the font family the value is stored as an attribute of MML node under font family chtml goes to the tree of MML node and Encounters this node to chtml is called on that node handle Styles and thus this. styles.css text is called as a result this transforms that string into this right here because it assumes the font family only stores the valid font family names but it doesn't realize that it's actually just turned into a full CSS style setting including everything else the produced string is then set as the value of the style attribute of the mtex node via set attribute CSS successfully injected nowhere along this chain does it actually check what is inside the square brackets it just assumes that because this is the way that this setting is supposed to be used nothing else is going to be included the one thing not explained here is this little bit at the end this is basically just saying draw this character in this case it's saying draw the empty character draw nothing there now do you want to know one of the two best parts about this this exploit never needed to be possible because you don't need to set the font family by setting the entire style there is a system in JavaScript for just setting specifically the font family and when you set it like this it automatically does sanitization so if you include something more than just the font family it's going to assume it's an invalid font going through CSS text and setting the entire Style is the harder way to do it it is the more roundabout way of doing this now this was the initial form of the exploit but it did get patched and then a slightly different variation started to exist all that happened is this slash right here was change with this string what does that string mean well it's the hex code for backslash initially they didn't properly patch this out and they just patched out specifically writing backslash you can inject backslash in other ways and that got the exploit working again at this point it seems like it is completely patched on github's side if you go to a repo or a profile that is making use of this you're going to see this error message the following macros are not allowed Unicode and then the rest of the string being written out here now I said there were two best parts here and I've only told you one of them so let's look at the second one this is not a new issue this got reported on November 13th 2023 on the math Jack repo this is marked as open but the reason it is marked as open is it's merged into the development Branch it has been in the development Branch since November 21st 2023 this has been patched for over 7 months but that does not mean that GitHub was running an older version they could be running the most up-to-date version and it wouldn't have fixed anything because the latest stable release was June 9th 2022 almost a year and a half prior to the bug being patched now there is a Beta release that came out on May 1st that does have the patch inside of it but a platform like GitHub probably shouldn't be running beta libraries so they had no way of running the patched version and no way of knowing it had already been patched this was a dumb little problem that never really needed to happen in the first place but it got fixed so quickly that really it didn't do any damage and yes there are certain things that can be done with CSS which could be problematic but hey what we saw was fun and that's all that matters so if you saw this when it was happening uh let me know your thoughts thoughts down below did you run into any repos that you were very surprised why they looked weird and did you make your repo look weird I would love to know and if there happens to be an arch do send it to me on like Twitter or something on Master on or Discord I want to see it anyway that's going to be it for me so if you like the video go like the video and if you really like the video and you want to become one of these amazing people over here Che out the patreon grabs baray Link in the description down below that's going to be it for me and inject the CSS right into my veins [Music]