Detecting and exploiting path-relative stylesheet import (PRSSI) vulnerabilities
Summary: PortSwigger Research published a walkthrough of path-relative stylesheet import (PRSSI) attacks, a technique Gareth Heyes dubbed Relative Path Overwrite, in which browsers are tricked into importing HTML pages as stylesheets by abusing the path-handling features of PHP, .NET, JSP and many frameworks. The post uses a real flaw in phpBB3, classified as CVE-2015-1431 and fixed in version 3.0.13, to show how tolerant CSS parsing plus Quirks mode lets an attacker inject CSS and, in phpBB3's case, leak a logged-in user's session key through the Referer header.
What you should know: The phpBB3 flaw let a single crafted URL disclose a logged-in user's session token via the Referer header, and because phpBB3 ties session tokens to IP addresses by default, a remote attacker would need to proxy through the victim's browser using DNS rebinding to use it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026