PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing CSP with dangling iframes

portswigger.net | research | #web-security | #chrome | #iframes | #csp-bypass | #dangling-markup | #window-name
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A CSP bypass found when Chrome 97 broke a dangling-markup lab: setting a cross-domain iframe to about:blank hands ownership to the attacker, exposing window.name and running script despite CSP.
Published
Collected

Related coverage

research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Hijacking service workers via DOM Clobbering
A new service worker hijacking variant using DOM clobbering: abusing a document.getElementById() quirk to control importScripts() and run script inside the SW, enabling filter evasion and CSP bypass.
Back