csp-bypass-advanced

SKILL: CSP Bypass — Advanced Techniques

AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps.

0. RELATED ROUTING

• xss-cross-site-scripting for XSS vectors to deliver after CSP bypass
• dangling-markup-injection when CSP blocks scripts but HTML injection exists — exfiltrate without JS
• crlf-injection when CRLF can inject CSP header or steal nonce via response splitting
• waf-bypass-techniques when both WAF and CSP must be bypassed
• clickjacking when CSP lacks frame-ancestors — clickjacking still possible

1. CSP DIRECTIVE REFERENCE MATRIX

Critical insight: base-uri, form-action, and frame-ancestors do NOT fall back to default-src. Their absence is always a potential bypass vector.

2. BYPASS TECHNIQUES BY DIRECTIVE

2.1 script-src 'self'

The app only allows scripts from its own origin. Bypass vectors:

2.2 script-src with CDN Whitelist

script-src 'self' *.googleapis.com *.gstatic.com cdn.jsdelivr.net

Trick: Search for JSONP endpoints on whitelisted domains: site:googleapis.com inurl:callback

2.3 script-src 'unsafe-eval'

eval(), Function(), setTimeout(string), setInterval(string) all permitted.

// Template injection → RCE-equivalent in browser
[].constructor.constructor('alert(document.cookie)')()
 
// JSON.parse doesn't execute code, but if result is used in eval context:
// App does: eval('var x = ' + JSON.parse(userInput))

2.4 script-src 'nonce-xxx'

Only scripts with matching nonce attribute execute.

2.5 script-src 'strict-dynamic'

Trust propagation: any script created by an already-trusted script is also trusted, regardless of source.

2.6 Angular / Vue CSP Bypass

Angular (with CSP):

Vue.js:

2.7 Missing object-src

If object-src is not set (falls back to default-src), and default-src allows some origins:

2.8 Missing base-uri

This bypasses 'nonce-xxx', 'strict-dynamic', and script-src 'self' for relative script paths.

2.9 Missing frame-ancestors

CSP without frame-ancestors → page can be framed → clickjacking possible.

X-Frame-Options header is overridden by frame-ancestors if CSP is present. But if CSP exists without frame-ancestors, some browsers ignore XFO entirely.

3. CSP IN META TAG vs. HEADER

Meta tag limitations:

• Cannot set frame-ancestors (ignored in meta)
• Cannot set report-uri / report-to
• Cannot set sandbox
• If injected via HTML injection before the meta tag in DOM order, attacker's meta CSP may be processed first (browser uses first encountered)
• If page has both header CSP and meta CSP, both apply (most restrictive wins)

4. DATA EXFILTRATION DESPITE CSP

When connect-src, img-src, etc. are locked down, alternative exfiltration channels:

DNS-based exfiltration is nearly impossible to block with CSP — this is the most reliable channel.

5. CSP BYPASS DECISION TREE

6. TRICK NOTES — WHAT AI MODELS MISS

1. default-src 'self' does NOT restrict base-uri or form-action — these have no fallback. This is the #1 CSP mistake.
2. strict-dynamic ignores whitelist: When strict-dynamic is present, host-based allowlists and 'self' are ignored for script loading. Only nonce/hash and trust propagation matter.
3. Multiple CSPs stack: If both Content-Security-Policy header and <meta> CSP exist, the browser enforces BOTH — the effective policy is the intersection (most restrictive).
4. Content-Security-Policy-Report-Only does not enforce — it only reports. Check for the correct header name.
5. Nonce length matters: Nonces should be ≥128 bits of entropy. Short or predictable nonces can be brute-forced or guessed.
6. Report-uri information disclosure: CSP violation reports sent to report-uri contain blocked-uri, source-file, line-number — this can leak internal URLs, script paths, and page structure to whoever controls the report endpoint.
7. data: in script-src: script-src 'self' data: allows <script src="data:text/javascript,alert(1)"> — trivial bypass, but commonly seen in real-world CSPs.