Hacker News Reader

Comment by ubernostrum | Hacker News Reader

While this is a neat technical trick, it does appear to require that an attacker also be able to inject a script tag with a specific source of the attacker's choice. Which feels like cheating, kind of; for a web application that's pretty much the equivalent of "well, assume you already have root on the victim's machine, once you have that you can do THIS".

View on HN

That's the point, it's about bypassing Content-Security-Policy, so you musy already have something like xss. It's more like "well, assume you have code execution inside a sandbox, then you can break out using THIS".

It still doesn't work, though. Taking the full scenario into effect, it's:

1. If the site has a CSP allowing JavaScript from "self", and

2. If the site has an upload feature hosted on the domain of "self", and

3. If the site gives someone the ability to inject a script tag pointing to an arbitrary target,

4. Then it's exploitable.

But conditions 1-3 effectively are the "you've already been rooted" case. This is a technically-interesting way to exploit the fact, but in itself is not the vulnerability; it's simply exploiting a vulnerability that was already there and wide open.

CSP is supposed to protect the website when there is a xss in it as a defence in depth solution. So a CSP bypass is when, it fails to do so. #1 - this is true for any site using CSP with javascript. #3 - the site is not giving the ability to inject the script tag. It is just an xss vulnerability which should have been caught by CSP, but in this case it doesnt.

Reply on news.ycombinator.com