CSP Bypass

Tags: csp, xss, jsonp

Level: advanced

Method

1. Parse the policy

   script-src, object-src, base-uri, frame-src, nonce/hash, strict-dynamic. Error pages often have a weaker policy than the app shell.

2. Look for 'unsafe-inline' / wildcards

   If unsafe-inline is present without a nonce, you are done. If a CDN wildcard is present, look for JSONP or Angular on that CDN.

3. JSONP and gadgets on allowed hosts

   Allowed origins that host JSONP, old Angular, or user-controlled files (S3, uploads, gist-like) become script-src.

   Tools: gau, waymore

4. Nonce reuse and leakage

   Nonce in a URL, in a cached page, or reused across requests. A reflection that can close a script tag and reuse the nonce is enough.

   Tools: Burp Suite

5. base-uri and object-src

   Missing base-uri lets a <base href> retarget relative script src. Missing object-src may allow Flash-class plugins on ancient apps; rare now.

Field notes

• Do not report 'CSP missing'. Report the XSS and mention why CSP failed to save them.
• The CSP parser on /utils/ is the first step, not a finding.

References

• https://content-security-policy.com/
• https://portswigger.net/research/bypassing-csp-with-jsonp