Security: Cannot use Content Security Policy to prevent data exfiltration
Reported by
ma7h1a...@gmail.com,
Jul 27 2017
|
|||||||||
Issue descriptionAFFECTED PRODUCTS -------------------- chrome 59.0.3071.115 DESCRIPTION -------------------- Latest Google Chrome 59.0.3071.115 failed to apply CSP restrictions to a new feature "download" of <a> element,caused csp-bypass problem for firefox,This attribute only works for same-origin URLs. https://developer.mozilla.org/en/docs/Web/HTML/Element/a PoC -------------------- poc.html,which enable the content security policy,please put it on the local httpserver and set a cookie for test this attacks shows that your cookie is sent to a remote server bypass the content security policy http://www.math1as.com/xsslog.txt shows the cookie received x.gif,shows how this attack works. SOLUTION -------------------- follow mozilla's document. CREDIT -------------------- This vulnerability was discovered by mathiaswu of Tencent's Xuanwu Lab.
,
Jul 27 2017
CSP doesn't govern navigations or downloads today. It's a weakness in CSP, and sounds like a reasonable feature request (that we're sketching out a solution to in https://w3c.github.io/webappsec-csp/#navigation-to), but not something I'd consider a vulnerability. CCing jochen@ for the same-origin download question, as I think he's working through that in https://groups.google.com/a/chromium.org/forum/#!topic/Blink-dev/Iw3_SUcagGg.
,
Jul 27 2017
It's not true that this attribute only works for same origin URLs in Firefox. If the URL is cross origin and doesn't send a Content-Disposition header, Firefox will attempt to navigate to it. When it's a file it would download typically, the navigation will still end in a download (e.g. for .exe files)
,
Jul 27 2017
,
Jul 27 2017
It sounds like the correct course of action is to reclassify this as a public Feature Request, like "Enable CSP to govern navigation"?
,
Jul 31 2017
Based on the discussion so far, I agree that this is a feature request, more than a bug report.
,
Sep 21 2017
Actually making this bug public.
,
Oct 9 2017
,
Nov 10 2017
,
Feb 18 2018
|
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by vakh@chromium.org
, Jul 27 2017Components: Blink>SecurityFeature>ContentSecurityPolicy
Owner: andypaicu@chromium.org