ONTAP Discussions

Content-Security-Policy HTTP header Not Implemented

52DevOps
7,941 Views

Title of Vulnerability: Content Security Policy (CSP) Not Implemented - Risk Level: Moderate (CVSS=5.0) ONTAP 9.3P6

Rationale/Finding Description: The NetApp devices web interface failed to implement the CSP protection. CSP, if implemented prevents cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.                                                                      

It’s a browser side mechanism that allows  to create whitelists for client side resources of the web interface (JavaScript, CSS, images, etc.). CSP is delivered via a special HTTP header that instructs the browser to only execute or render resources from the white list.                                                                           

An attack requires publicly available tools, considerable amount of time and knowledge of the existing code injection weaknesses in the web interface.                                                                                                                                        

A successful attack could allow an attacker to successfully exploit the web interface in the event of code injection attacks like XSS attacks.

Recommendation for Mitigation: Enable CSP on the web interface by sending the Content-Security-Policy in HTTP response headers. For example: Content-Security-Policy: default-src 'self'; script-src 'self'

 

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

 

 

11 REPLIES 11

GidonMarcus
7,848 Views

Hi,

 

is there a question we are missing on this thread ?

 

Thanks

Gidi Marcus (Linkedin) - Storage and Microsoft technologies consultant - Hydro IT LTD - UK

52DevOps
7,829 Views

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

kryan
7,814 Views

Which version of ONTAP does this information pertain to?

52DevOps
7,803 Views

9.3P6

52DevOps
7,719 Views

No one has had to fix this issue? Is there an expected time-frame from NetApp on mitigating this issue? 

 

If I can get to the web config files this can be resolved quickly, however not sure where to find those files. Anyone knows about it?

kryan
7,704 Views

Have you opened a support case where additional data might be found?

If not, please share the source of this finding and the CVSS score vectors.

52DevOps
7,691 Views

1) No

 

2) Nessus scans do show this as an issue. 

kryan
7,685 Views

Please provide the Nessus plugin from the result.

kryan
7,609 Views

Please confirm that this is the result you are observing:

 

https://www.tenable.com/plugins/nessus/50344

Plugin #50344

Info

Missing or Permissive Content-Security-Policy frame-ancestors HTTP Response Header

Description
The remote web server in some responses sets a permissive Content-Security-Policy (CSP) frame-ancestors response header or does not set one at all.
The CSP frame-ancestors header has been proposed by the W3C Web Application Security Working Group as a way to mitigate cross-site scripting and clickjacking attacks.
Solution
Set a non-permissive Content-Security-Policy frame-ancestors header for all requested resources.

52DevOps
6,424 Views

Sounds similar to our issue. What's the fix for it ?

kryan
6,367 Views

In order to resolve the CSP Nessus result on port 443, open a support case and ask for assistance with the workaround for bug 1200750.

Public