CSP bypass: self + 'unsafe-inline' with Iframes

👉 Overview

👀 What ?

CSP (Content Security Policy) bypass with 'self' and 'unsafe-inline' alongside iframes is a technique where an attacker can inject malicious scripts into a webpage, despite the presence of a CSP. This technique specifically uses the 'self' and 'unsafe-inline' directives within a CSP, which allow scripts from the same origin and inline scripts (embedded within HTML) to be executed, respectively. Iframes are used to load content from another webpage into the current webpage.

🧐 Why ?

Understanding this technique is crucial because it highlights one of the ways in which CSPs can be bypassed, potentially leading to cross-site scripting (XSS) attacks. XSS is a common vulnerability that allows attackers to inject malicious scripts into webpages viewed by other users, leading to a variety of potential exploits such as stealing user data, defacing websites, or redirecting users to malicious sites.

⛏️ How ?

To bypass a CSP with 'self' and 'unsafe-inline' using iframes, an attacker first needs to find a page within the same origin that is vulnerable to an injection attack. The attacker can then inject a script tag pointing to a URL on the same origin, and use an iframe to load this page. The loaded script will execute within the context of the original page, despite the CSP. This technique takes advantage of the fact that 'self' allows scripts from the same origin, and 'unsafe-inline' allows inline scripts.

⏳ When ?

The use of CSP bypass techniques has grown in prominence with the increasing adoption of CSPs as a security measure. Though CSPs have been around since around 2012, it's difficult to pinpoint exactly when this specific bypass technique began to be used. However, as awareness and understanding of CSPs and their limitations have grown, so too have attempts to exploit these limitations.

⚙️ Technical Explanations

In a Content Security Policy (CSP), the 'self' directive allows resources to be loaded from the same origin as the page. The 'unsafe-inline' directive allows the execution of inline scripts and styles. Together, these directives can sometimes be exploited to bypass the intended restrictions of the CSP. An attacker could inject a script tag into a page on the same origin that is vulnerable to an injection attack. This script would be allowed to execute because it falls under the 'self' directive. If the attacker also includes an iframe in the injection, pointing to the page with the injected script, the script will execute when the iframe is loaded. This happens because the 'unsafe-inline' directive allows inline scripts, which includes scripts loaded into iframes. This technique demonstrates how, despite the best intentions, security measures can sometimes be turned against themselves in unexpected ways.