Security researchers have created a breakthrough that challenges the perceived security of nonce-based Content Security Policy ( CSP), combining HTML injection, CSS-based nonce leakage, and browser cache manipulation to demonstrate a practical way to bypass these protections.
The Structure: A Genuine XSS Challenge
The research is centered on a bare-bones online application with a dashboard and a signup form.
A nonce-based CSP, which is widely accepted as a strong defense against cross-site scripting ( XSS), provides protection for the dashboard.
Each page load generates a unique nonce that is embedded in both the CSP and the , <, script>,  , label, potentially allowing only trusted scripts to do.
However, the program has a simple flaw: using , person insight is inserted into the page. without appropriate cleaning, innerHTML .
The researchers discovered a way to avoid this protection, despite the CSP’s recommendation to prevent any scripts that were injected.
Step 1: Using CSS Injection to Flushing the Nonce
The primary challenge is obtaining the nonce price, which is necessary for the execution of any injected text. The researchers made use of the fact that the CSP did never restrict , <, style>,  , keywords, or physical stylesheets.
The site ‘s , <, meta>, and  , sticker, which contains the CSP policy, was leaked by the carefully crafted CSS candidates.
This method uses feature candidates and context image requests to exfiltrate the nonce in little fragments, which are then reassembled server-side, in response to previous CTF challenges.
Step 2: Exploiting Browser Caching ( disk cache and bfcache )
The second task is to add a load that will be executed with the appropriate nonce with the nonce already in hand.
The researchers here used browser caching mechanisms, particularly the back/forward cache ( bfcache ) and disk cache.
By manipulating the user’s profile data with a new via a CSRF attack, they forced the browser to serve an old version of the dashboard page ( with the known nonce ) from disk cache while manipulating the navigation history and cache keys (using query parameters ).
The injected script could successfully execute without the nonce-based CSP because of this separation of the HTML ( with the old nonce ) and the dynamic data ( with the new payload ).
Phase 3: Relevance in the Real World
This invasion demonstrates that even well-configured nonce-based CSPs may be defeated:
- HTML or CSS treatment is a possible way to leak the nonce.
- The attacker may change the behavior of the browser cache to use a identified nonce.
- The application allows dynamic content updates that are not tightly coupled to the nonce lifecycle ( for example, via fetch or AJAX ).
The research emphasizes the value of integrated web security. CSP nonces are a potent application, but they are not a magic solution.
Developers must make sure that website storage behaviors are understood and accounted for in their danger models, that person input is effectively sanitized, and that nonces may be leaked.
This finding serves as a reminder that intruders will continue to find creative ways to utilize unanticipated interactions between online solutions because security is only as strong as its weakest link.
Register for Free to Attend the Special Webinar Alert: Using Intel ® Processor Innovations for Advanced API Security.