USING FORM HIJACKING TO BYPASS CSP

Summary from the TLDR InfoSec newsletter

Form hijacking is where an attacker exploits an HTML injection vulnerability by utilizing the formaction attribute or injecting their own form, thereby bypassing CSP. This is possible because the form-action directive was added in CSP v2 and is not covered by default-src. This post lists options to fix this and presents an overview of different scans in Burp Suite related to CSPs.