Hunting nonce-based CSP bypasses with dynamic analysis
Summary: PortSwigger researcher Gareth Heyes describes how a routine Burp Scanner dynamic analysis run against portswigger.net flagged a nonce-based CSP bypass, where an input element's value was used to control a script URL. The gadget was a querySelector call that fetched the Recaptcha Client Url, which an attacker with an injection point before the selector's target could hijack by injecting an element with the ID "RecaptchaClientUrl-" and having their script executed.
Why it matters: A nonce-based CSP only holds if the JavaScript it protects is bug-free, and this bypass came from a subtle gadget in the site's own Recaptcha code rather than a flaw in the policy itself. The fix Heyes recommends is to avoid giving an attacker control over the script URL by specifying a static string for the script's location.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026