  Relative Path Overwrite (RPO) is a recent technique to inject style
directives into sites even when no style sink or markup injection vulnerability
is present. It exploits differences in how browsers and web servers interpret
relative paths (i.e., path confusion) to make a HTML page reference itself as a
stylesheet; a simple text injection vulnerability along with browsers' leniency
in parsing CSS resources results in an attacker's ability to inject style
directives that will be interpreted by the browser. Even though style injection
may appear less serious a threat than script injection, it has been shown that
it enables a range of attacks, including secret exfiltration.
  In this paper, we present the first large-scale study of the Web to measure
the prevalence and significance of style injection using RPO. Our work shows
that around 9% of the sites in the Alexa Top 10,000 contain at least one
vulnerable page, out of which more than one third can be exploited. We analyze
in detail various impediments to successful exploitation, and make
recommendations for remediation. In contrast to script injection, relatively
simple countermeasures exist to mitigate style injection. However, there
appears to be little awareness of this attack vector as evidenced by a range of
popular Content Management Systems (CMSes) that we found to be exploitable.
