# Exploiting CSP in Webkit to Break Authentication & Authorization

WebKit's CSP violation event leaked the final cross-origin redirect URI, letting attackers steal OAuth codes/tokens from SSO flows and take over accounts.

- Payout: unconfirmed
- Severity: high
- Program: Apple
- Credited: Sachin Thakuri, Prakash
- Disclosed: 2021-11-13
- CVE: CVE-2021-30682, CVE-2021-30888
- Write-up quality: 8/10
- Original: https://threatnix.io/blog/exploiting-csp-in-webkit-to-break-authentication-authorization/
- Library page: https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization
- Tags: domain:browser impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth tech:sso technique:chained technique:parser-differential vuln:account-takeover vuln:info-disclosure

**Target:** WebKit CSP SecurityPolicyViolationEvent / CORS fetch error handling
**Root cause:** WebKit set SecurityPolicyViolationEvent.documentURI to the final redirect target instead of the original request URL, violating W3C spec and leaking cross-origin redirect URIs containing OAuth codes/tokens. A second CORS bug leaked destination URL via fetch catch handler.
**Steps:**
1. Host page with CSP `default-src 'self' auth.example.com` and a SecurityPolicyViolation event listener
2. Trigger fetch to auth endpoint that 302-redirects cross-origin to app with `?code=...`
3. Redirect to non-whitelisted origin fires CSP violation; read `documentURI` which contains full redirect URL with code
4. Use stolen code at authorization endpoint with attacker-generated state to log into victim account
5. Bypass UA-based fixes via `<a ping>` on iOS; second 0day: add catch handler to fetch to read destination URL via CORS error
**How found:** Studied prior Chromium CSP blocked-uri leak reports (Homakov 2013) and W3C spec; noticed Safari's documentURI differed from other browsers on cross-origin redirect, hypothesizing OAuth redirect URIs would leak.
**Exploitation:** Attacker page whitelists the SSO auth domain in CSP, fetches the authorization endpoint; the cross-origin redirect back to the app (carrying code/token) violates CSP and the event's documentURI leaks the full URL. Attacker replays the code with a fresh state/nonce to authenticate as victim. ITP bypassed by requiring user interaction via window.open and polling.
**Escalation:** Chained across OAuth/SSO providers (Facebook, Google, Instagram, WhatsApp) and 'Login with' integrations to achieve account takeover at scale; bypassed UA-based fixes using <a ping> on iOS WebKit.
**Insight:** CSP violation reports and CORS error objects can leak full redirect URLs; test browser event attributes against spec on cross-origin redirects, and check whether UA-sniffing fixes can be bypassed by alternate request primitives like <a ping> on iOS where all browsers share WebKit.