I am reading this blog post about an vulnerability on uber.com. It says that you will have to set a content security policy:

We’ll set our policy to only allow requests to partners.uber.com, which will block https://login.uber.com/logout/* Hence a 302 redirect to https://login.uber.com/logout/ will be prevented.

But how can I change the CSP policy of a website I have no control of? The Website Uber is not mine and the author has listed code below showing HTML and Javascript to use. But where should I put the code? I am not allowed to enter HTML or JavaScript, right?

  • 1
    Just take a closer look at this blog and you will notice that the author shows a fragment from a HTML page shortly after the sentence you cite. And there you can see the restrictive CSP policy defined inside its own HTML page. – Steffen Ullrich Nov 23 '17 at 19:47

If you read the full blog article that you linked, you will see that it is not just a simple XSS attack. In fact, it is two CSRF attacks and one XSS attack combined.

The content security policy is used in the CSRF part of the attack, on a page controlled by the attacker that they would trick the victim into visiting. This is how any CSRF attacks work. The site in question can be any site on the web, it doesn't matter. The only important part is that you can get the victim to visit it.

So no, you can't change the CSP of a page you don't control. But that is not what the author of the blogpost is suggesting. They are changing it on their own page, using the http-equiv attribute of the meta tag:

<meta http-equiv="Content-Security-Policy" content="img-src partners.uber.com">

The attack that is described is rather complicated. To understand it better, I suggest you read up on CSRF attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.