Weak CSP / missing nonce
script-src 'unsafe-inline', wildcards, JSONP allowlists, Angular/JS frameworks hosted on allowed CDNs, nonce reuse, base-uri missing, object-src missing.
Tags: csp, xss
Typical severity: P4
What it becomes
CSP is not a vuln. A weak CSP is a gadget that turns a hard XSS into a working one.
Where to look
every HTML responseerror pages (often weaker CSP)email HTML viewers
Chains
- XSS — JSONP on an allowed origin, Angular sandbox gadgets, nonce leakage into a page you inject, or 'unsafe-inline'.
Notes
- Parse CSP on /utils/. Do not report 'CSP missing' unless the program asks. Report the XSS, mention CSP as the reason it executes.