Full Report
Content Security Policies (CSP) are a secondary line of defense for XSS bugs in the browser. So, as an attacker, having ways to circumvent the CSP is important for a full exploit chain. The case for form hijacking is when you have an HTML injection vulnerability but can't escalate it to XSS because of the CSP. By adding a form to the page it may be possible to extract sensitive data, especially from over-eager password managers. In the case of Mastadon, this worked to steal passwords with Chrome and a single user click. In this Gareth made the inputs have an opacity of zero to make it invisible. The form-action was created as a directive in CSPv2. However, default-src doesn't cover form actions for some reasons. Overall, an interesting CSP bypass that will probably exist for a while.
Analysis Summary
# Tool/Technique: CSP Bypass via Form Hijacking
## Overview
This technique involves bypassing Content Security Policy (CSP) restrictions to exfiltrate sensitive data via HTML injection. When a CSP prevents the execution of malicious scripts (XSS), an attacker can instead inject a rogue `<form>` element. This form is designed to intercept user credentials or sensitive information, often leveraging the auto-fill behavior of browser password managers to steal data without needing to execute JavaScript.
## Technical Details
- **Type:** Technique (Exploitation/Exfiltration)
- **Platform:** Web Browsers (specifically noted in Chrome; affects any browser with auto-fill features)
- **Capabilities:** Data theft, credential harvesting, CSP circumvention.
- **First Seen:** Publicly discussed in the context of Mastodon vulnerabilities (Gareth Heyes).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- T1555.003 - Credentials from Web Browsers
- **TA0010 - Exfiltration**
- T1048 - Exfiltration Over Alternative Protocol (via HTTP POST/GET)
## Functionality
### Core Capabilities
- **HTML Injection:** Exploits existing vulnerabilities to insert rogue HTML tags into a trusted page.
- **Form Action Overwriting:** Defines a malicious `action` attribute in the injected form to send data to an attacker-controlled server (e.g., `https://attacker[.]com/collect`).
- **CSP Bypass:** Exploits the fact that the `default-src` directive in CSPv2 does not automatically restrict the `form-action` directive. If `form-action` is not explicitly defined, the browser allows the form to submit data to any destination.
### Advanced Features
- **Invisible Overlays:** Setting the CSS `opacity` of injected inputs to zero (`opacity: 0`). This hides the rogue fields from the user while allowing them to remain focusable or interactable.
- **Password Manager Exploitation:** Leveraging "over-eager" browser password managers that automatically fill in credentials when they detect an input field within a form, even if that form was injected by an attacker.
- **User-Interaction Trigger:** Requiring only a single user click (e.g., a "Submit" or "Login" button) to trigger the exfiltration of the auto-filled data.
## Indicators of Compromise
- **File Hashes:** N/A (Web-based injection)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- Outbound HTTP POST requests to unauthorized or suspicious external domains (e.g., `https[:]//attacker-domain[.]com/exfil`).
- **Behavioral Indicators:**
- Presence of multiple `<form>` tags where only one is expected.
- Form elements with `opacity: 0` or other styles intended to hide them from the UI.
- Submissions to domains not listed in the application's standard operational scope.
## Associated Threat Actors
- Generally used by web exploit developers and red teamers. No specific APT group is uniquely tied to this, as it is a general web exploitation technique.
## Detection Methods
- **Behavioral Detection:** Monitoring for DOM changes that introduce new `<form>` elements with external `action` attributes.
- **Web Application Firewalls (WAF):** Inspecting inbound traffic for common HTML injection payloads (e.g., `<form`, `<input`, `action=`).
- **CSP Auditing:** Using browser developer tools or automated scanners to check if the `form-action` directive is missing or overly permissive.
## Mitigation Strategies
- **Explicit CSP Directives:** Always define the `form-action` directive in the Content Security Policy. Do not rely on `default-src`.
- *Example:* `Content-Security-Policy: form-action 'self';`
- **Input Sanitization:** Implement rigorous server-side sanitization and output encoding to prevent HTML injection vulnerabilities in the first place.
- **Autocomplete Attributes:** Set `autocomplete="off"` on sensitive fields, though note that many modern browsers may ignore this for password fields.
- **Frame Busting:** Prevent the site from being framed, which can sometimes mitigate specific overlay-based hijacking.
## Related Tools/Techniques
- **Cross-Site Scripting (XSS):** The primary vulnerability this technique bypasses when XSS is blocked.
- **Phishing:** A similar outcome, but performed on a legitimate domain rather than a spoofed one.
- **Clickjacking:** A related technique involving invisible overlays to trick users into performing unintended actions.