Attack Chain

1. An attacker identifies a service that accepts user-submitted CSS and processes it using PostCSS, leveraging its default postcss().process() behavior.
2. The attacker crafts a malicious CSS input containing a /*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */ comment.
3. The service invokes postcss().process() on the attacker's CSS, with the map option left at its default (true).
4. During processing, PostCSS's loadMap() function attempts to resolve the sourceMappingURL annotation.
5. The path.join() operation, combined with loadFile(), processes the traversal sequence, allowing access to .map files outside the intended directory.
6. PostCSS successfully reads the arbitrary .map file (e.g., bundle.js.map) from the server's filesystem.
7. The sourcesContent field from the read .map file, which often contains actual source code, is merged into the result.map object generated by PostCSS.
8. The vulnerable service, following typical build pipeline behavior, outputs or returns the result.map to the attacker, leading to the disclosure of sensitive file contents.

Impact

This vulnerability leads to the disclosure of contents from arbitrary .map files accessible by the PostCSS process's privileges on the filesystem. The impact is significant as .map files frequently contain embedded source code and project structure information which, if exposed, can reveal intellectual property, internal logic, or aid in further attacks. Any application processing untrusted CSS without explicitly disabling source map generation (via map: false) is vulnerable. No authentication or user interaction beyond submitting the malicious CSS is required. The specific number of victims is unknown, but given PostCSS's widespread use in web development, a large number of applications could be at risk.

Recommendation

• Upgrade PostCSS to version 8.5.18 or later as soon as patches become available to remediate the path traversal vulnerability documented in GHSA-r28c-9q8g-f849.
• For immediate mitigation or if upgrading is not feasible, configure any application processing untrusted CSS with PostCSS to explicitly set the map: false option in the postcss().process() call. This prevents PostCSS from attempting to load source maps and nullifies the exploitation vector described in this brief.
• Review the application's handling of result.map to ensure that if source maps are legitimately generated, they are not inadvertently exposed to untrusted entities.