Full Report
Content Security Policies (CSP) are an XSS defense mechanism. Of course, if you found XSS, you want to circumvent the CSP. This is a website with XSS gadgets known on various popular programs.
Analysis Summary
# Tool/Technique: CSP Bypass (XSS Gadgets)
## Overview
Content Security Policy (CSP) Bypasses via XSS Gadgets involve leveraging legitimate, trusted scripts—often from popular libraries and CDNs—to execute malicious JavaScript. While CSP is designed to mitigate Cross-Site Scripting (XSS) by restricting the sources of executable scripts, "gadgets" are snippets of code within allowed domains that can be repurposed to bypass these restrictions.
## Technical Details
- **Type**: Technique / Exploit Framework
- **Platform**: Web Browsers (Client-side)
- **Capabilities**: Execution of arbitrary JavaScript despite strict CSP headers, data exfiltration, and session hijacking.
- **First Seen**: Broadly documented by Google security researchers circa 2016-2017.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious Link
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0005 - Defense Evasion**
- T1562 - Impair Defenses
- T1211 - Exploitation for Defense Evasion
## Functionality
### Core Capabilities
- **Script Execution**: Utilizing allow-listed domains (like `google.com` or `cdnjs.cloudflare.com`) to load scripts that possess "gadget" properties.
- **Parser Differential Exploitation**: Using framework-specific syntax (e.g., Angular directives or Knockout.js data-binds) to execute logic that the CSP does not recognize as script.
### Advanced Features
- **JSONP Bypass**: Leveraging JSONP endpoints on trusted domains to execute callback functions containing malicious payloads.
- **Script-less Exfiltration**: Using non-script directives (like `style-src` or `img-src`) to exfiltrate data via DNS or HTTP requests if the policy is overly permissive.
## Indicators of Compromise
- **File Hashes**: N/A (Technique-based)
- **File Names**: Inclusion of legitimate but vulnerable libraries (e.g., `angular.js`, `jquery.js`, `knockout.js`).
- **Registry Keys**: N/A
- **Network Indicators**:
- `cdnjs[.]cloudflare[.]com` (commonly abused in payloads)
- `ajax[.]googleapis[.]com` (commonly abused in payloads)
- Unusual callbacks in JSONP requests: `?callback=alert(1)`
- **Behavioral Indicators**:
- Outbound requests to unknown domains initiated by trusted library functions.
- Large amounts of data encoded in URL parameters of image requests (Data Exfiltration).
## Associated Threat Actors
- **Magecart Groups**: Known for bypassing web security controls to inject skimmers.
- **General Cybercrime Operators**: Using XSS for credential harvesting.
- **Red Team Facilitators**: Often use the "CSPBypass" repository (as referenced) for penetration testing engagements.
## Detection Methods
- **Signature-based detection**: Monitoring for known XSS gadget patterns in URL parameters (e.g., `ng-app`, `data-bind`, `{{constructor...}}`).
- **Behavioral detection**: Using Subresource Integrity (SRI) to detect if third-party scripts have been modified, though gadget-based attacks usually use the original script maliciously.
- **Content Monitoring**: Deploying CSP Violation Reports (`report-uri` or `report-to`) to monitor when unauthorized scripts attempt to execute.
## Mitigation Strategies
- **Strict CSP Implementation**: Move away from allow-lists toward **Nonce-based** or **Hash-based** CSPs.
- **CSP Evaluator**: Use tools like Google’s CSP Evaluator to identify bypasses in existing headers.
- **Avoid JSONP**: Replace JSONP with CORS (Cross-Origin Resource Sharing) to prevent callback injection.
- **Library Sanitization**: Ensure that client-side frameworks are up-to-date and configured to prevent expression injection.
## Related Tools/Techniques
- **[CSPBypass (renniepak)](https://github.com/renniepak/CSPBypass)**: A specialized search tool for finding known gadgets in popular web programs.
- **Google CSP Evaluator**: A tool for auditing CSP headers for common weaknesses.
- **DOM-based XSS**: Often the entry point for gadget-based CSP bypasses.