Data ONTAP Discussions

Content-Security-Policy HTTP header Not Implemented

Title of Vulnerability: Content Security Policy (CSP) Not Implemented - Risk Level: Moderate (CVSS=5.0) ONTAP 9.3P6

Rationale/Finding Description: The NetApp devices web interface failed to implement the CSP protection. CSP, if implemented prevents cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.                                                                      

It’s a browser side mechanism that allows  to create whitelists for client side resources of the web interface (JavaScript, CSS, images, etc.). CSP is delivered via a special HTTP header that instructs the browser to only execute or render resources from the white list.                                                                           

An attack requires publicly available tools, considerable amount of time and knowledge of the existing code injection weaknesses in the web interface.                                                                                                                                        

A successful attack could allow an attacker to successfully exploit the web interface in the event of code injection attacks like XSS attacks.

Recommendation for Mitigation: Enable CSP on the web interface by sending the Content-Security-Policy in HTTP response headers. For example: Content-Security-Policy: default-src 'self'; script-src 'self'

 

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

 

 

11 REPLIES 11

Re: Content-Security-Policy HTTP header Not Implemented

Hi,

 

is there a question we are missing on this thread ?

 

Thanks

Highlighted

Re: Content-Security-Policy HTTP header Not Implemented

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

Re: Content-Security-Policy HTTP header Not Implemented

Which version of ONTAP does this information pertain to?

Re: Content-Security-Policy HTTP header Not Implemented

9.3P6

Re: Content-Security-Policy HTTP header Not Implemented

No one has had to fix this issue? Is there an expected time-frame from NetApp on mitigating this issue? 

 

If I can get to the web config files this can be resolved quickly, however not sure where to find those files. Anyone knows about it?

Re: Content-Security-Policy HTTP header Not Implemented

Have you opened a support case where additional data might be found?

If not, please share the source of this finding and the CVSS score vectors.

Re: Content-Security-Policy HTTP header Not Implemented

1) No

 

2) Nessus scans do show this as an issue. 

Re: Content-Security-Policy HTTP header Not Implemented

Please provide the Nessus plugin from the result.

Re: Content-Security-Policy HTTP header Not Implemented

Please confirm that this is the result you are observing:

 

https://www.tenable.com/plugins/nessus/50344

Plugin #50344

Info

Missing or Permissive Content-Security-Policy frame-ancestors HTTP Response Header

Description
The remote web server in some responses sets a permissive Content-Security-Policy (CSP) frame-ancestors response header or does not set one at all.
The CSP frame-ancestors header has been proposed by the W3C Web Application Security Working Group as a way to mitigate cross-site scripting and clickjacking attacks.
Solution
Set a non-permissive Content-Security-Policy frame-ancestors header for all requested resources.
Forums