Ambushed by AngularJS: A Hidden CSP Bypass in Piwik PRO
In the realm of website security, even seemingly harmless components can pose a threat to the overall safety of a site. This includes analytics platforms, which, if not properly audited, can become a gateway for potential vulnerabilities. Piwik PRO, a popular analytics platform, was recently subjected to such an audit to ensure its safety on portswigger.net. The audit uncovered a hidden bypass in the platform’s Content Security Policy (CSP), involving the use of AngularJS.
Get Rana Adnan’s stories in your inbox
Join Medium for free to get updates from this writer.
If you want to read About The Benefits of Hiring an AngularJS Development Company for Your Web Application
Understanding Client-side Issues
When it comes to client-side issues, one common vulnerability to investigate is DOM XSS (Cross-Site Scripting). This vulnerability arises when new script resources are introduced and can potentially serve as a vector for attacks. To examine the presence of DOM XSS in Piwik PRO, a tool called DOM Invader was utilized. This tool allows for the injection of canaries to identify any vulnerabilities. Fortunately, no results were found using this method, providing a sense of relief.
Discovering the Analytics Debugger
During the audit, attention turned to an analytics debugger that was observed on the Piwik PRO site. Further investigation revealed an “ng-app” event, indicating the involvement of AngularJS. AngularJS is known for its script gadgets that can bypass CSP, making it a valuable tool for attackers. Script gadgets are JavaScript code snippets, often from a library, that enhance the capabilities of HTML or JavaScript. By utilizing these gadgets, attackers can leverage the pre-existing JavaScript execution and bypass CSP.
Two Possible Outcomes
Once an AngularJS gadget is identified, there are two potential outcomes to consider. The first possibility is client-side template injection (CSTI), which requires an HTML injection vulnerability to inject script resources. However, in this case, CSTI was not feasible. This left the team with the second outcome: a CSP bypass. Fixing a CSP bypass is crucial because, when combined with an HTML injection vulnerability, it can lead to the escalation of the attack to Cross-Site Scripting (XSS).
Analyzing the Debugger
A closer inspection of the analytics debugger revealed the use of an iframe and the loading of various script resources. These resources were allowed by the CSP, providing an opportunity for bypassing its restrictions. To tackle this issue, the team consulted an XSS cheat sheet specific to AngularJS. This cheat sheet contains various techniques for bypassing CSP in AngularJS. Among the options, the team chose the most suitable one for their scenario.
Exploiting the CSP Bypass
Armed with the knowledge from the XSS cheat sheet, the team constructed a payload to exploit the CSP bypass. The payload involved injecting AngularJS directives and an ng-focus event using the composedPath() method to access the window object. By using the orderBy filter, the payload could execute the alert function indirectly, bypassing the CSP. The team promptly reported this vulnerability to Piwik PRO, which took immediate action to address the issue.
Reporting and Fixing the Issue
The team reported the CSP bypass to Piwik PRO, initiating the process of resolving the vulnerability. Piwik PRO acknowledged the report and confirmed the existence of the vulnerability. In response, they updated their CSP deployment instructions to rectify the issue. Instead of allowing the entire domain, they tightened the CSP by specifically allowing a particular JavaScript file. Additionally, nonces were implemented for certain scripts, preventing attackers from injecting their own AngularJS script resources.
Timeline of Events
The following is a timeline of the key events related to the discovery and resolution of the AngularJS CSP bypass in Piwik PRO:
- 2nd Mar 2023, 10:51 — Reported CSP bypass to Piwik PRO
- 2nd Mar 2023, 11:20 — Acknowledged by Piwik PRO
- 3rd Mar 2023, 13:09 — Vulnerability confirmed
- 7th Mar 2023, 12:24 — CSP deployment instructions updated to fix vulnerability
- 28th April 2023, 13:00 — Blog post released
Conclusion
The discovery of a hidden CSP bypass in Piwik PRO highlights the importance of thorough audits and testing of analytics platforms. This incident serves as a reminder that even seemingly harmless components can pose a security risk if not properly assessed and secured. By promptly reporting the vulnerability and implementing necessary fixes, Piwik PRO demonstrated its commitment to maintaining a secure platform. As the web continues to evolve, staying vigilant and proactive in addressing potential vulnerabilities is crucial for safeguarding websites and protecting user data.
