Insecure or unset HTTP headers - Content-Security-Policy
Description
The application has unnsafe configurations regarding the Content-Security-Policy header. This may be because:
- Header is missing from server responses.
- The header has not defined mandatory security policies.
- Defined security policies contain insecure values.
Impact
- Embed content, scripts, blobs or images from potentially malicious sources.
- Make possible to carry attacks like Cross-Site Scripting, Cross-Site Leaks, among others.
Recommendation
Set the Content-Security-Policy header in the server responses and configure it in a secure way.
Threat
Unauthorized attacker from Internet.
Expected Remediation Time
⌚ 15 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: N
- User interaction: R
- Scope: U
- Confidentiality: L
- Integrity: L
- Availability: N
Temporal
- Exploit code madurity: P
- Remediation level: O
- Report confidence: C
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
- Score:
- Base: 4.2
- Temporal: 3.8
- Severity:
- Base: Medium
- Temporal: Low
Code Examples
Compliant code
Securely configure the content security policy in the http headers
HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self' trusted.com *.trusted.com
Non compliant code
The content security policy is incorrectly configured in the http headers
HTTP/1.1 200 OK
Content-Security-Policy: frame-ancestors 'none'