CSP Bypass

web security

Definition

CSP Bypass

A CSP bypass is any technique that lets an attacker execute script despite a Content Security Policy. The most direct is the unsafe-inline directive, which voids protection outright; subtler classes exploit features the policy fails to constrain.

Class	Mechanism
unsafe-inline	explicitly allows inline scripts, undoing the nonce/hash regime
Base URI hijack	injecting <base> to redirect relative script URLs to attacker-controlled hosts
JSONP	a trusted host that serves a JSONP endpoint can be wrapped as <script src=...?callback=alert(1)> to run arbitrary code under an allowed host
Nonce stealing	exfiltrating the per-response nonce, e.g. via an injection that reads the DOM
Code reuse / script gadgets	legitimate frameworks react to crafted DOM elements (e.g. data-role=button) and turn safe markup into script execution
DOM clobbering	overwriting globals via named DOM elements to break security scripts
Missing object-src	allowing <object>/<embed> to load plugins that execute script
Open redirects	a redirect pointed at an allowed host re-routed to attacker content
Unrestricted file uploads	uploaded files served from an allowed origin run as script
[[Knowledge/Server-Side Request Forgery	SSRF]]

Each of these converts an apparently safe-but-trusted feature into execution; defence is to write a policy without unsafe-inline, restrict base-uri and object-src, and prefer nonces with strict-dynamic.