Bypassing CSP Nonces via the Browser's Disk Cache— This article describes a sophisticated technique for bypassing Content Security Policy (CSP) using nonce values by exploiting browser caching mechanisms.
Content Security Policy (CSP) is a security standard for web developers that restricts the sources from which scripts and design elements can be loaded when a website is opened in a browser.
The purpose of CSP is to reduce the risk of third-party code injection attacks, such as cross-site scripting (XSS).
The author will demonstrate how a combination of CSS injections, CSRF attacks, and the specific operation of bfcache and disk cache can lead to the execution of arbitrary JavaScript code even with strict CSP.
