Using form hijacking to bypass CSP
Summary: PortSwigger researcher Gareth Heyes described form hijacking, a technique that uses an HTML injection to set a form's action or formaction attribute so credentials are posted to an attacker's server, bypassing CSP when the form-action directive is missing. Heyes cited a real-world case on Infosec Mastodon, where a Mastodon fork that did not filter HTML let an attacker capture credentials after Chrome's password manager auto-filled them, and a bug bounty report from Johan Carlsson that earned $1,500 for showing an AngularJS injection bypass of PortSwigger's own CSP and its lack of form hijacking protection.
What you should know: The form-action directive arrived in CSP version 2 and is not covered by default-src, so a policy that looks complete can still let an injected form send credentials to an attacker's server - the same gap that hit Infosec Mastodon and PortSwigger's own site.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026