PostCSS Path Traversal Vulnerability via Source Map Auto-Loading

A significant path traversal vulnerability, identified as GHSA-r28c-9q8g-f849, has been discovered in PostCSS, a popular CSS processing tool, affecting versions up to 8.5.17. This flaw stems from the tool's default behavior of auto-detecting and attempting to load "previous source maps" specified in /*# sourceMappingURL=... */ comments within CSS text. An attacker can manipulate these comments with directory traversal sequences (e.g., ../../../) or absolute paths to bypass intended directory restrictions, coercing PostCSS into reading arbitrary .map files from the filesystem. If the application then returns the processed result.map (a common practice in build pipelines), the attacker can extract sensitive information contained within the sourcesContent field of these disclosed .map files. This vulnerability requires no authentication and can be triggered by submitting specially crafted CSS to any service that processes untrusted CSS with PostCSS without explicitly setting the map: false option.

Attack Chain

1. An attacker identifies a service that accepts user-submitted CSS and processes it using PostCSS, leveraging its default postcss().process() behavior.
2. The attacker crafts a malicious CSS input containing a /*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */ comment.
3. The service invokes postcss().process() on the attacker's CSS, with the map option left at its default (true).
4. During processing, PostCSS's loadMap() function attempts to resolve the sourceMappingURL annotation.
5. The path.join() operation, combined with loadFile(), processes the traversal sequence, allowing access to .map files outside the intended directory.
6. PostCSS successfully reads the arbitrary .map file (e.g., bundle.js.map) from the server's filesystem.
7. The sourcesContent field from the read .map file, which often contains actual source code, is merged into the result.map object generated by PostCSS.
8. The vulnerable service, following typical build pipeline behavior, outputs or returns the result.map to the attacker, leading to the disclosure of sensitive file contents.

Impact

This vulnerability leads to the disclosure of contents from arbitrary .map files accessible by the PostCSS process's privileges on the filesystem. The impact is significant as .map files frequently contain embedded source code and project structure information which, if exposed, can reveal intellectual property, internal logic, or aid in further attacks. Any application processing untrusted CSS without explicitly disabling source map generation (via map: false) is vulnerable. No authentication or user interaction beyond submitting the malicious CSS is required. The specific number of victims is unknown, but given PostCSS's widespread use in web development, a large number of applications could be at risk.

Recommendation

• Upgrade PostCSS to version 8.5.18 or later as soon as patches become available to remediate the path traversal vulnerability documented in GHSA-r28c-9q8g-f849.
• For immediate mitigation or if upgrading is not feasible, configure any application processing untrusted CSS with PostCSS to explicitly set the map: false option in the postcss().process() call. This prevents PostCSS from attempting to load source maps and nullifies the exploitation vector described in this brief.
• Review the application's handling of result.map to ensure that if source maps are legitimately generated, they are not inadvertently exposed to untrusted entities.