Bypass CSP nonce using base href="data:..."
Reported by
masa....@gmail.com,
Feb 7 2017
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36 Steps to reproduce the problem: PoC: <html> <head> <meta http-equiv=content-security-policy content="object-src 'none';script-src 'nonce-random-secret'"> <title> Fake XSS </title> </head> <body> <base href=data:/,-alert(1)/> <script src="./lib/jquery.js" nonce=random-secret></script> </body> </html> Online PoC: https://jsbin.com/vigodiqifo/1/edit?html,output What is the expected behavior? Will see alert box. What went wrong? Base uri changed script uri bypassed nonce prevent. Did this work before? N/A Chrome version: 55.0.2883.95 Channel: n/a OS Version: OS X 10.12.0 Flash Version: Shockwave Flash 24.0 r0
,
Feb 7 2017
Can be reproduced in current stable too. Adding security labels. mkwst@, could you help triage this issue? Thanks!
,
Feb 8 2017
<base href=http://html5sec.org>,HTTP uri also work.
,
Feb 8 2017
Yeah, I added metrics to M57 for exactly this case (which look pretty low), and filed https://github.com/whatwg/html/issues/2249 to see about changing the spec. Anne wasn't terribly impressed, but I think it's still a change worth making. As for the `http` version, that's expected: if you care about preventing `<base>` injection, `base-uri` is there for you. I believe "Strict CSP" folks plan to add it to their recommendations. CCing Artur as an FYI. Dropping visibility flags, as this is a known and public issue.
,
Feb 8 2017
Yes, I also filed a bug for a documentation change in the spec to mention that base-uri is important for nonce-based policies: https://github.com/w3c/webappsec-csp/issues/177 I'm planning to push a change to Google's public CSP documentation (csp.withgoogle.com) to mention this Real Soon Now.
,
Feb 14 2017
Duping this into 679318, where I landed a patch to prevent `data` from being used as a `<base href>`. |
||||
►
Sign in to add a comment |
||||
Comment 1 by elawrence@chromium.org
, Feb 7 2017Labels: OS-Windows
Status: Untriaged (was: Unconfirmed)
Summary: Bypass CSP nonce using base href="data:..." (was: Bypass CSP nonce)