Cisco researchers have found a way to bypass the Content Security Policy and allow attackers to exploit the issue and potentially disclose confidential data by injecting otherwise excluded code. To the browser, the injected code would appear to originate from the same server as the legitimate application therefore allowing access to local resources that can lead to the leak of potentially confidential data to the attacker or even application session hijacking.Ĭontent Security Policy (CSP) is a mechanism designed to prevent XSS attacks by whitelisting servers that may be used as legitimate sources for the client side web application code.

XSS allows the attacker to inject remote code within the context of the original server code executing in the browser. One particularly successful attack technique is Cross Site Scripting (XSS).

However, many vulnerabilities in web applications allowing the attacker to bypass the same-origin policy have been discovered. On the other hand, a script originating from the server should not be able to access any data on.

The essence of the same-origin policy is that it allows programmatic access to web resources only to the code that originates from the same server as the data that is being accessed.įor example, a script, executing within the context of a web browser, originating from the server should be able to access data from the same server. One of the fundamental security mechanisms of a web application is the so called same-origin policy, prescribing which resources may be accessed by the application code.

Piriform speccy class not registered