Bypassing CSP via DOM clobbering
Summary: PortSwigger researcher Gareth Heyes published a technique on 5 June 2023 for bypassing Content Security Policy using DOM clobbering, demonstrated on a test case modeled on a bug bounty site. The method requires three conditions - HTML injection, a gadget of one or more property names, and a sink allowed by the policy - and in the example two injected anchor tags clobber properties named ehy and codeBasePath so the gadget lands in a script.src attribute, with a question mark moving the /utils.js filename into the query string. DOM Invader, Burp's DOM clobbering detection tool, flagged the sink named script.src.
Key Takeaway: A nonce plus strict-dynamic policy lets a nonce-protected script generate further scripts, so a single HTML injection that reaches a clobbered script.src can turn that allowance against the site. PortSwigger warns that enabling DOM clobbering detection may break the page under test, which is why it recommends turning it on only for the specific page being tested.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026