PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

portswigger.net | research | #web-security | #dom-xss | #csp-bypass | #angularjs | #piwik-pro | #script-gadget
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
Published
Collected

Related coverage

research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
research · portswigger.net
XSS without HTML: Client-Side Template Injection with AngularJS
Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
research · portswigger.net
Concealing payloads in URL credentials
Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
Back