CSP Credential Theft Without JavaScript via Missing form-action or Allowed Same-Page Submissions, meta refresh, and Referer

1. Overview

• Article Title: Blind trust: stealing credentials through CSP
• Publisher: PortSwigger Research
• Publication Date: 2026-11-11T14:26:00Z
• Original: PortSwigger Research
• Updated Date: 2026-11-12T15:55:00Z
• Author's Response Priority: High
• Priority Rationale: The research reproducibly demonstrates that credential exfiltration can succeed without JavaScript even under a policy containing default-src 'none', when form-action is omitted or allows submissions to the same page. These implementation conditions can be overlooked in CSP assessments. This is the report author's prioritization, not an official vendor severity rating or CVSS score.

Related Materials

• None

2. Key Takeaways

PortSwigger added a PoC to its Burp AT skill that uses reflected HTML injection and takes advantage of the fact that CSP's form-action directive does not fall back to default-src. By leveraging settings where form-action is either unspecified or permits same-page submissions, the PoC uses only a form submission and a meta referrer/refresh to load credentials into the Referer header. The public demo page itself sets default-src 'none'; form-action 'self', which permits GET submissions to the same page and enables the attack.

• The CSP form-action directive does not fall back to default-src. If form-action is unspecified, form submission destinations cannot be restricted solely by default-src 'none'.
• The prerequisites include the ability to reflect attacker-controlled HTML, the capacity to inject a form containing credential input fields and a submit button, and a second-stage meta element payload held as a string inside a textarea that gets submitted as a reflected parameter and interpreted as a meta element on the reflection page.
• In the first stage, user-entered values in the injected form are submitted via GET to the same-origin second stage, which then navigates to Collaborator using meta name=referrer content=unsafe-url and meta refresh.
• The browser includes the full URL containing credentials in the Referer header and sends it to Collaborator without JavaScript.
• The Burp AT skill analyzes over 350 allow-list gadgets, multiple policy intersections, fallbacks, strict-dynamic, nonces, and report-only headers to generate the PoC.

3. Research Objectives

• Determine whether credentials can be exfiltrated through directive fallback gaps even when script execution is blocked by CSP.
• Evaluate whether CSP bypass assessment and PoC generation can be automated using agent skills.

4. Methodology and Workflow

• Parse policies and evaluate multiple policy intersections, fallbacks, and allow-list gadgets.
• Generate a PoC using two-stage HTML injection and meta navigation when form-action is unspecified or permits same-page submissions, even without script gadgets.

Workflow

• HTML injection -> injected form with credential input fields performing a GET request to the same-origin second stage -> second-stage payload in a textarea is reflected and interpreted as a meta element -> unsafe-url Referrer-Policy -> meta refresh -> Collaborator receipt.

5. Inputs and Outputs

Inputs

• CSP headers, reflected HTML injection points, injected forms containing credential input fields with reflection parameters, and Burp requests/responses.
• Knowledge base of over 350 allow-list gadgets including JSONP and AngularJS.

Outputs

• Verdicts per directive, preconditions, and a PoC that sends a Referer containing credentials to Collaborator.

6. Evaluation Design

• Scope: PortSwigger's controlled PoC and policy analysis using the Burp AT skill.
• Success Metric: The Referer of the Collaborator request contains the input credentials without using JavaScript.
• Human Role: A tester specifies the reflection parameter or verifies the skill's estimation, and executes the PoC in a safe environment.

7. Results

• In the public demo, form-action 'self' permitted GET submissions to the same page, allowing Referer exfiltration via the second-stage meta element and external navigation. As per the specification, default-src does not apply when form-action is unspecified.
• Meta refresh is a navigation action, and this chain was not subject to CSP script restrictions.
• Collaborator received the full URL containing credentials via the Referer header.

8. Practical Implications

• Even default-src 'none' does not guarantee that unspecified directives are safe.
• CSP evaluations must examine page structures, fallbacks, navigation mechanisms, and Referrer-Policy settings rather than header strings alone.

9. Preconditions, Limitations, and Application

Preconditions

• Presence of attacker-controlled HTML injection.
• form-action is either unspecified or configured to permit destinations such as the same page.
• Users enter credentials into the injected form and submit it.
• The second-stage payload within a textarea is reflected, interpreted as a meta element, and causes the browser to send the full URL Referer externally.

Limitations

• While JavaScript is not required, HTML injection and specific page structures are necessary.
• Real-world exploitation has not been observed.
• Results may vary depending on the browser, Referrer-Policy, and URL processing behavior.

Application Guidance

• Explicitly define destination allow-lists using form-action. However, settings like form-action 'self' or permissions allowing submissions to vulnerable same pages do not prevent this technique (the public demo succeeds under form-action 'self').
• Setting Referrer-Policy to no-referrer or strict-origin variants is a common mitigation against leakage, but it does not serve as a standalone defense against this technique because an injected meta referrer can override the document policy to unsafe-url.
• The primary countermeasure is fixing HTML injection vulnerabilities through context-aware output encoding and trusted templating, independent of CSP.
• Validate multiple policies in real browsers.

Required Evidence

• All CSP and Referrer-Policy response headers.
• Reflection points, DOM structures, form destinations, and navigation sequences.
• Collaborator requests, Referer headers, browser versions, and reproduction steps.

10. Facts, Inference, and Hypothesis

Facts

• The CSP form-action directive does not fall back to default-src. If form-action is unspecified, form submission destinations cannot be restricted solely by default-src 'none'.
• The prerequisites include the ability to reflect attacker-controlled HTML, the capacity to inject a form containing credential input fields and a submit button, and a second-stage meta element payload held as a string inside a textarea that gets submitted as a reflected parameter and interpreted as a meta element on the reflection page.
• In the first stage, user-entered values are submitted via GET to the same-origin second stage, which then navigates to Collaborator using meta name=referrer content=unsafe-url and meta refresh.
• The browser includes the full URL containing credentials in the Referer header and sends it to Collaborator without JavaScript.
• The Burp AT skill analyzes over 350 allow-list gadgets, multiple policy intersections, fallbacks, strict-dynamic, nonces, and report-only headers to generate the PoC.

Inference

• Even when CSP is implemented as an XSS defense, credential confidentiality can be compromised through the combination of directive fallback rules and HTML injection.

Hypothesis

• No additional hypotheses

11. MITRE ATT&CK Mapping

No individual mappings apply due to the nature of this security research.

12. Uncertainties and Further Investigation

• Exploitation cases and incident counts in production sites have not been reported.
• Variations in success depending on browsers, Referrer-Policy settings, page structures, and URL lengths require individual validation.

13. Implications for Defenders

Even in web applications where CSP is already implemented, assessments must account for the combination of HTML injection, unspecified form-action or permitted same-page submissions, and unsafe Referrer-Policies. The presence of a policy header alone cannot determine resistance to XSS or credential theft; validation must include directive fallback rules and page structures.

14. Summary by Stakeholder

• For SOCs: Check for credential-bearing GET requests from login pages to the same origin followed immediately by external navigation and Referer leakage.
• For Administrators: Explicitly configure form-action with destination allow-lists. However, settings like 'self' or permitted same-page submissions do not prevent this technique, and strict Referrer-Policies can be overridden by injected meta referrers, meaning they do not suffice as standalone controls. Focus primarily on fixing injection vulnerabilities through HTML output encoding.
• For Users: If a login screen appears normal but features unusual URLs or redirection destinations, do not enter credentials and instead reopen the page from official bookmarks.