---
id: 5450
title: "Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/ambushed-by-angularjs-a-hidden-csp-bypass-in-piwik-pro"
published_at: "2023-04-28T12:31:00Z"
tags: ["web-security", "dom-xss", "csp-bypass", "angularjs", "piwik-pro", "script-gadget"]
phying_url: "https://phying.com/item/5450"
lang: en
---

# Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO

## Summary

A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-04-28T12:31:00Z
- **Original:** https://portswigger.net/research/ambushed-by-angularjs-a-hidden-csp-bypass-in-piwik-pro
- **Phying News:** https://phying.com/item/5450