ONTAP Discussions

Content-Security-Policy HTTP header Not Implemented

52DevOps

Title of Vulnerability: Content Security Policy (CSP) Not Implemented - Risk Level: Moderate (CVSS=5.0) ONTAP 9.3P6

Rationale/Finding Description: The NetApp devices web interface failed to implement the CSP protection. CSP, if implemented prevents cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.                                                                      

It’s a browser side mechanism that allows  to create whitelists for client side resources of the web interface (JavaScript, CSS, images, etc.). CSP is delivered via a special HTTP header that instructs the browser to only execute or render resources from the white list.                                                                           

An attack requires publicly available tools, considerable amount of time and knowledge of the existing code injection weaknesses in the web interface.                                                                                                                                        

A successful attack could allow an attacker to successfully exploit the web interface in the event of code injection attacks like XSS attacks.

Recommendation for Mitigation: Enable CSP on the web interface by sending the Content-Security-Policy in HTTP response headers. For example: Content-Security-Policy: default-src 'self'; script-src 'self'

 

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

 

 

11 REPLIES 11

GidonMarcus

Hi,

 

is there a question we are missing on this thread ?

 

Thanks

Gidi Marcus (Linkedin) - Storage and Microsoft technologies consultant - Hydro IT LTD - UK

52DevOps

For implementing CSP the header needs to be modified, has anyone done this? Would like to know how to do it.

 

https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/

kryan

Which version of ONTAP does this information pertain to?

52DevOps

9.3P6

52DevOps

No one has had to fix this issue? Is there an expected time-frame from NetApp on mitigating this issue? 

 

If I can get to the web config files this can be resolved quickly, however not sure where to find those files. Anyone knows about it?

kryan

Have you opened a support case where additional data might be found?

If not, please share the source of this finding and the CVSS score vectors.

52DevOps

1) No

 

2) Nessus scans do show this as an issue. 

kryan

Please provide the Nessus plugin from the result.

kryan

Please confirm that this is the result you are observing:

 

https://www.tenable.com/plugins/nessus/50344

Plugin #50344

Info

Missing or Permissive Content-Security-Policy frame-ancestors HTTP Response Header

Description
The remote web server in some responses sets a permissive Content-Security-Policy (CSP) frame-ancestors response header or does not set one at all.
The CSP frame-ancestors header has been proposed by the W3C Web Application Security Working Group as a way to mitigate cross-site scripting and clickjacking attacks.
Solution
Set a non-permissive Content-Security-Policy frame-ancestors header for all requested resources.

52DevOps

Sounds similar to our issue. What's the fix for it ?

kryan

In order to resolve the CSP Nessus result on port 443, open a support case and ask for assistance with the workaround for bug 1200750.

Announcements
NetApp on Discord Image

We're on Discord, are you?

Live Chat, Watch Parties, and More!

Explore Banner

Meet Explore, NetApp’s digital sales platform

Engage digitally throughout the sales process, from product discovery to configuration, and handle all your post-purchase needs.

NetApp Insights to Action
I2A Banner
Public