> For the complete documentation index, see [llms.txt](https://ressurect.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ressurect.gitbook.io/notes/web/content-security-policy/xss-static-nonce-in-csp.md).

# XSS (Static Nonce in CSP)

**Scenario:** The application is using a Content-Security-Policy (CSP) that blocks [inline scripts](https://content-security-policy.com/examples/allow-inline-script/) from executing. There is a possibility of a Stored XSS as the application is not performing input validation or output encoding.

The following is the portion of CSP header:

{% code overflow="wrap" %}

```css
Content-Security-Policy: ... script-src 'self' 'unsafe-eval' 'nonce-G3cdmbi5XK1gg-JadtzFMw' 'https://<trusted-url>' ...
```

{% endcode %}

From the above policy, we can note the following:

1\. 'self': Can only load JavaScript from the same origin of app and scripts from external URL's will be blocked.

2\. No 'unsafe-inline': we cannot execute inline scripts such as:

```html
<script>
	doSomething();
</script>
```

OR

```html
<button onClick="doSomething();">Do It</button>
```

> Note: **alert('XSS');** is also an example of a function call such as **doSomething();** Both would be blocked.

3\. 'nonce ...': Scripts with the specified nonce value can be executed.

**Observation:** After browsing the application for a while and observing the value of CSP header, we can conclude that the application does not rotate the **nonce** value with each HTTP request. This would increase the execution rate of our payload.

**XSS Payload:** The following payload successfully executed:

```html
<script nonce="nonce-G3cdmbi5XK1gg-JadtzFMw">alert(document.domain);</script>
```

**References:**

{% embed url="<https://content-security-policy.com/unsafe-inline/>" %}

{% embed url="<https://content-security-policy.com/nonce/>" %}