Content Security Policy inline-script bypass

Content Security Policy inline-script bypass

Announced

June 5, 2012

Reporter

Adam Barth

Impact

High

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR

Fixed in

• Firefox 13
• Firefox ESR 10.0.5
• SeaMonkey 2.10
• Thunderbird 13
• Thunderbird ESR 10.0.5

Description

Security researcher Adam Barth found that inline event handlers, such as onclick, were no longer blocked by Content Security Policy's (CSP) inline-script blocking feature. Web applications relying on this feature of CSP to protect against cross-site scripting (XSS) were not fully protected.

References

• <img onerror="..."> execute even when inline scripts are blocked by CSP
• CVE-2012-1944
• Content Security Policy