alx-alexpark/canvas-discussion-css-exploit.md

## canvas-discussion-css-exploit.md

      
    Raw
  

              canvas-discussion-css-exploit.md
            
          
    Funny CSS Exploit in Canvas

Notice: You can share this, however be cautious because it might be patched

⚠️Having this exploit something that few people know about reduces all our chances of getting in trouble⚠️

Vendor: Instructure 

Product: Canvas 

Versions affected: Unknown (No version indication on website) (Working as of Feb 6 2023) 

Attack type: Remote 

Severity: Low 

Impact:

CSS Hijacking ⚠️

Attack vector: Discussion post HTML/CSS functionality
Description: CSS you put in discussion posts will be applied throughout the entire page
Limitations: Some CSS options will not work
Reproduction instructions


Open any canvas discussion post, your post will likely need to be on the first page for the CSS to be rendered
Open the code editor in the reply menu
Paste the following

<head>
  <style>
  /* Your css here */
  </style>
</head>

Post the discussion post, and whoever loads your post will get the css applied page-wide

Some funny things


display: none;
background-image: url();
* {color: /*color*/; background-color: /*color*/}