Using Form Hijacking to Bypass Content Security Policy
PortSwigger researcher Gareth Heyes details a technique known as form hijacking, which allows attackers to bypass Content Security Policy (CSP) protections and steal user credentials. This method exploits HTML injection vulnerabilities by injecting malicious form actions or entire forms, leveraging the fact that CSP's default-src directive does not cover form submissions. The article highlights real-world instances, including a vulnerability found in Infosec Mastodon where attackers could harvest passwords auto-filled by browser managers. Additionally, it discusses a bug bounty report by Johan Carlsson regarding PortSwigger’s own site, which revealed similar CSP weaknesses involving AngularJS injection. The root cause is identified as the omission of the form-action directive in CSP configurations. To mitigate these risks, the author recommends specifying form-action with 'none' or 'self' and using secure random nonces for scripts and styles instead of allowlisting URLs or using unsafe-inline directives. PortSwigger has also released new passive scan checks in Burp Suite to detect such CSP misconfigurations, aiming to raise awareness and improve web application security standards against these overlooked attack vectors.
Wire timeline
Using Form Hijacking to Bypass Content Security Policy
PortSwigger researcher Gareth Heyes details a technique known as form hijacking, which allows attackers to bypass Content Security Policy (CSP) protections and steal user credentials. This method exploits HTML injection vulnerabilities by injecting malicious form actions or entire forms, leveraging the fact that CSP's default-src directive does not cover form submissions. The article highlights real-world instances, including a vulnerability found in Infosec Mastodon where attackers could harvest passwords auto-filled by browser managers. Additionally, it discusses a bug bounty report by Johan Carlsson regarding PortSwigger’s own site, which revealed similar CSP weaknesses involving AngularJS injection. The root cause is identified as the omission of the form-action directive in CSP configurations. To mitigate these risks, the author recommends specifying form-action with 'none' or 'self' and using secure random nonces for scripts and styles instead of allowlisting URLs or using unsafe-inline directives. PortSwigger has also released new passive scan checks in Burp Suite to detect such CSP misconfigurations, aiming to raise awareness and improve web application security standards against these overlooked attack vectors.
PortSwigger Research