Later archive addition

Relative Path Overwrite

Gareth Heyes

Relative Path Overwrite adds a trailing slash or fake directory segments to a URL so a page's relative stylesheet reference resolves back to the page itself. The browser then parses the HTML as CSS, and attacker-controlled reflected or stored text beginning with a brace becomes live CSS, giving style injection everywhere and script execution through expressions in older IE modes.

Record

Researcher

Gareth Heyes

In the archive

• Added to the 2014 archive after the original list was published
• Nominated for the 2015 Top 10 Web Hacking Techniques

Related sources

• Practical follow-up (2015)
• Detection methodology (2014)

Tags

• css-injection
• xss
• css
• url-parsing
• parser-differential
• php
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.