CSS Injection on GitHub Profiles: From Unicode Exploits to New Bypass Techniques
GitHub profiles are a great way for developers to showcase their work, and customizing these profiles can add a personal touch. However, customization comes with risks, especially when users find ways to inject e.g CSS into their profiles, which can potentially compromise the security and integrity of the platform. This blog explores a previously noted and blocked CSS injection method using the \unicode
command and I will later show a new way to bypass the filter.
The Original Exploit: Unicode Command Injection
Initially, users discovered a method to inject CSS styles into their GitHub profiles using LaTeX math mode with the \unicode
command. Here’s an example of the code that was used:
$$\ce{$\unicode[goombafont; color:red; pointer-events: none; z-index: 100; position: fixed; top: 0; left: 0; height: 100vh; object-fit: cover; background-size: cover; width: 100vw; opacity: 1.0; background: url('https://github.com/stevemats/stong/blob/master/Rotating_cube_SMIL.svg?raw=true');]{x0000}$}$$
This code used LaTeX to inject styles into the profile page, altering its appearance by placing an image as the background and applying various CSS properties.
GitHub’s Response: Blocking the Unicode Command
To prevent this exploit, GitHub implemented a filter to block the \unicode
command in LaTeX math mode. This was a necessary step to maintain the security and integrity of the platform. Users attempting to use the \unicode
command now receive an error message: "The following macros are not allowed: \unicode."
A Way to Bypass The Filter: HTML Character Encoding
Despite the filter, users have found new ways to bypass these restrictions. One such method involves using HTML character encoding to disguise the \unicode
command. Here’s an example of the updated code:
```math \ce{$\unicode[goombafont; color:red; pointer-events: none; z-index: -10; position: fixed; top: 0; left: 0; height: 100vh; object-fit: cover; background-size: cover; width: 130vw; opacity: 0.5; background: url(‘https://user-images.githubusercontent.com/30528167/92789817-e4b53d80-f3b3-11ea-96a4-dad3ea09d237.png?raw=true');]{x0000}$}
Replace https://user-images.githubusercontent.com/30528167/92789817-e4b53d80-f3b3-11ea-96a4-dad3ea09d237.png?raw=true with your image.
How it Works
- HTML Character Encoding- The sequence
\
is the HTML entity for the backslash (\
). By encoding the backslash, the code avoids directly writing the\unicode
command, which GitHub’s filter is designed to block.
2. LaTeX Math Mode - The code is still enclosed within LaTeX math mode markers ($$...$$
), allowing the use of LaTeX commands.
3. Chemical Equation (ce) Environment - The \ce
command is used as a wrapper, potentially disguising the intent of the code.
4. Unicode Command Injection - Once decoded and processed, the \
entity is interpreted as a backslash, effectively executing the \unicode
command with the specified CSS properties.
Why It Bypasses the Filter
- Encoding Trick: By using
\
, the command is hidden from the filter that blocks\unicode
. - Command Interpretation: When the encoded character is rendered, the LaTeX processor interprets it correctly as a backslash, executing the command.
Why GitHub This Loophole is Being Addressed
GitHub decided to close this issue and restrict the use of the \unicode
command and might do so for the new methods for several important reasons:
- Security Risks - Allowing arbitrary CSS injection can lead to significant security vulnerabilities. Users could manipulate the appearance of not only their profiles but also create misleading or malicious elements that could trick others.
- Site Integrity - CSS injection disrupts the consistent appearance and functionality of the site. If everyone could freely alter page layouts, it would make the platform look unprofessional and untrustworthy.
- Abuse Prevention - Without restrictions, malicious actors could use CSS injection for harmful activities, such as phishing or spreading misinformation.
- User Experience - Excessive or disruptive styles injected through CSS could lead to poor user experiences, making some profiles unusable or visually overwhelming.