AngularJS CSP bypass in 56 characters

Gareth Heyes

Researcher

@garethheyes

• Published: 14 October 2019 at 13:04 UTC

• Updated: 12 January 2023 at 08:36 UTC

Often when you are testing websites you might encounter a length restriction on the input you are testing, that's why it's important to reduce the length of your vector as much as possible and of course it's really fun too.

When I did my XSS magic tricks talk at Allstars I presented a technique to bypass CSP using AngularJS in 63 characters:

It works by using the path property in Chrome which is an array of DOM objects which also contains the window object as the last element. The pipe character in AngularJS signifies a filter operation so the path array is sent to the orderBy filter and this accepts an expression. Then when the expression is executed the context in which it executes in the current element of the array. I then use the CSS property to detect when the array element is currently using the last element which is window. Then I use the map function to execute the alert function because the sandbox will detect window if calling alert as a normal function call. The vector is below:

I challenged the audience to reduce it further and Erlend Oftedal managed to do it by replacing the CSS property with "x" which is the ID of the injected input element. This works because "x" will be a global property of window and thus can be used to detect the window object. See below:

I posted this vector on Slackers with a challenge to reduce it further. Taking up the challenge myself, I thought of ways to call alert without triggering AngularJS window detection. I came up with using an array and the pop method:

This payload is the same length as the original. But wait - AngularJS allows you to call undefined functions silently without throwing exceptions. So I could reduce the payload by removing the && and property check:

Still determined to reduce it further I tried using an array without the pop by referencing the first element and calling it:

But this results in an illegal operation as the calling object is not window and JavaScript only lets us call alert on window. So I needed a way of calling alert as a direct call and maintaining the reference to window whilst still avoiding AngularJS's window check. Finally I came up with this simple but elegant method - using an assignment evades AngularJS's window object detection:

AngularJS CSP bypass PoC

Update...

Since Chrome 109 the path property has been removed. The workaround is to use composedPath() instead.

AngularJS CSP bypass PoC

Back to all articles