Researchers Unveil CSP Bypass Technique for Credential Theft
A new research paper details a method to exploit Content Security Policy misconfigurations, enabling attackers to steal user credentials through crafted HTML injections and malicious script sources.
Security researchers have identified a novel attack vector that circumvents Content Security Policy (CSP) protections, a crucial web security mechanism designed to prevent cross-site scripting (XSS) and other code injection attacks. The vulnerability lies not in a flaw within CSP itself, but in common misconfigurations that attackers can leverage to exfiltrate sensitive user credentials.
The primary method involves exploiting CSP's allow-list directives. If a CSP policy permits scripts to be loaded from a trusted domain that hosts a vulnerable JSONP endpoint or an outdated JavaScript library like AngularJS, an attacker can inject malicious code. This code, when executed from an allowed origin, can then be used to steal credentials from the compromised website, effectively bypassing the intended security controls.
To automate the detection of such weaknesses, researchers developed a Burp Suite extension. This tool analyzes CSP headers, identifies potential vulnerabilities, and constructs proof-of-concept exploits. It specifically looks for two main attack vectors: leveraging known "gadgets" on allow-listed domains and exploiting form-action directives for credential exfiltration.
The "allow-list gadget lookup" feature scans for domains listed in CSP's script-src (or fallback directives like script-src-elem and default-src) that are known to host code snippets capable of executing arbitrary JavaScript. The tool cross-references these sources against a database of over 350 known CSP bypass gadgets.
The second identified vector, "form-action credential exfiltration," targets scenarios where CSP might block JavaScript but still permit form submissions to the same origin (form-action 'self'). By injecting a malicious form into a page with an HTML injection vulnerability, an attacker can trick a user into submitting their credentials. The injected form can be crafted to include meta tags that force the browser to send the URL, including credentials in the Referer header, to an attacker-controlled server upon navigation.
This technique is particularly insidious because it can work even when default-src 'none' is set, as the form-action directive does not inherit from default-src. The researchers demonstrated a practical example using a vulnerable lab environment, showcasing how a carefully constructed payload could lead to credential theft via the Referer header and a subsequent meta-refresh redirect.
The findings highlight the critical importance of meticulously configuring CSP policies. Over-reliance on allow-lists without vetting the content of those domains, or neglecting the form-action directive, can leave web applications vulnerable. The research underscores the need for continuous security auditing and the use of automated tools to identify these subtle yet dangerous misconfigurations.