S7039 — Content Security Policies should be restrictive

Language
C#
Type
Vulnerability
Severity
Major

Why is this an issue?

The Content Security Policy (CSP) is a computer security standard that serves as an additional layer of protection against various types of attacks, including Cross-Site Scripting (XSS) and clickjacking. It provides a set of standard procedures for loading resources by user agents, which can help to mitigate the risk of content injection vulnerabilities.

However, it is important to note that CSP is not a primary line of defense, but rather a safety net that catches attempts to exploit vulnerabilities that exist in the system despite other protective measures. An insecure CSP does not automatically imply that the website is vulnerable, but it does mean that this additional layer of protection is weakened.

A CSP can be considered insecure if it allows potentially harmful practices, such as inline scripts or loading resources from arbitrary domains. These practices can increase the risk of content injection attacks.

What is the potential impact?

An insecure Content Security Policy (CSP) can increase the potential severity of other vulnerabilities in the system. For instance, if an attacker manages to exploit a Cross-Site Scripting (XSS) vulnerability, an insecure CSP might not provide the intended additional protection.

The impact of a successful XSS attack can be severe. XSS allows an attacker to inject malicious scripts into web pages viewed by other users. These scripts can then be used to steal sensitive information like session cookies, personal data, or credit card details, leading to identity theft or financial fraud.

Moreover, XSS can be used to perform actions on behalf of the user without their consent, such as changing their email address or password, or making transactions. This can lead to unauthorized access and potential loss of control over user accounts.

In addition, an insecure CSP that allows loading resources from arbitrary domains could potentially expose sensitive user data to untrusted sources. This could lead to data breaches, which can have serious legal and reputational consequences.

How to fix it

Code examples

Noncompliant code example


using System.Web;

public async Task InvokeAsync(HttpContext context)
{
    context.Response.Headers.ContentSecurityPolicy = "script-src 'self' 'unsafe-inline';"; // Noncompliant
}

Compliant solution


using System.Web;

public async Task InvokeAsync(HttpContext context)
{
    context.Response.Headers.ContentSecurityPolicy = "script-src 'self' 'sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';";
}

How does this work?

To fix an insecure Content Security Policy (CSP), you should adhere to the principle of least privilege. This principle states that a user should be given the minimum levels of access necessary to complete their tasks. In the context of CSP, this means restricting the sources from which content can be loaded to the minimum necessary.

Here are some steps to secure your CSP:

Resources

Documentation

Standards

↑ Back to top