Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
Summary: PortSwigger researcher Gareth Heyes found a CSP bypass in the Piwik PRO analytics platform after spotting an AngularJS 'ng-app' directive inside its debugger, which loaded scripts allow-listed by the site's CSP. Piwik PRO fixed it by tightening the CSP to allow-list a specific JavaScript file rather than a whole domain and by adding nonces to certain scripts, with the report made 2 March 2023 and the deployment instructions updated 7 March 2023.
What you should know: The bypass only escalates to XSS if a site already has an HTML injection flaw, so a third-party analytics script you allow-listed can turn a minor injection into full script execution under your own policy.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026