How to fix CWE 829 – Add CSP header correctly ?

CWE 829 - Inclusion of Functionality from Untrusted Control Sphere

Description

The Content-Security-Policy detected on the page does not restrict script execution via "script-src" or "default-src" directives.

If a Cross-Site-Scripting vulnerability exists within the page, an attacker could exploit it by injecting a script from untrusted source:

e.g. "<script scr=//malicious.attacker.com/a.js></script>". 

The policy would allow execution of this malicious script.

While lack of "script-src" or "default-src" directives does not represents a security risk by itself, they may serve as an additional protection layer from Cross-Site-Scripting attacks. These directives help to ensure that scripts on the website are loaded from approved sources specified in the policy.

Recommendations

It is recommended to move all scripts to trusted locations, such as a local server or trusted CDN. Then, in the Content-Security-Policy you may specify all these trusted locations:

 e.g.

"Content-Security-Policy: script-src 'https://static.example.com' 'https://cdn.example.com';"

Make sure that only "https" scheme is used, and avoid using asterisks ('*') as much as possible.

What is Content-Security-Policy header?

The Content-Security-Policy (CSP) is an HTTP response header that modern browsers use to improve web page security. It enables you to control which resources—such as JavaScript, CSS, and images—can be loaded and specify the allowed source URLs.

It basically defines the trusted sources of the resources.

CSP Directive Reference (https://content-security-policy.com/)

default-src defines the default policy for fetching resources such as JavaScript, Images, CSS, Fonts, AJAX requests, Frames, HTML5 Media. Not all directives fallback to default-src. 

e.g. :

default-src 'self' cdn.example.com;

Please note that keyword 'self' if the resources can be loaded from the same domain that serves html pages.

Here, default-src is allowing all the resources to be loaded locally from same domain as well as from a 3^rd party CDN domain which is cdn.example.com.

script-src Defines valid sources of JavaScript.

e.g. :

script-src 'self' js.example.com;

To address CWE-829, it is essential to define either the script-src or default-src directive in the Content-Security-Policy (CSP) header.

Since CSP was initially designed to mitigate Cross-Site Scripting (XSS) attacks, the script-src directive plays a crucial role in specifying trusted sources for JavaScript. If script-src is not explicitly defined, the default-src directive takes over this responsibility.

Additionally, CSP provides other directives such as style-src, img-src, font-src, and object-src, allowing more granular control over the sources of stylesheets, images, fonts, and embedded objects.

Below is an example of a CSP header incorporating these directives.

Content-Security-Policy: 
    default-src 'self'; 
    script-src 'self' https://cdn1.example.com https://cdn2.example.net 'nonce-random123'; 
    img-src 'self' https://images.example.com data:; 
    style-src 'self' https://cdn1.example.com 'unsafe-inline'; 
    font-src 'self' https://fonts.example.com; 
    connect-src 'self' https://api.example.net; 
    frame-src 'self' https://frames.example.com; 
    object-src 'none'; 
    base-uri 'self'; 
    form-action 'self'; 
    frame-ancestors 'none'; 
    report-uri https://csp-report.example.net/report;

Please note all directives are separated by semicolon (;) and for each directive values are separated by whitespace, few reserved keywords like "Self" , "unsafe-inline" , etc. are expressed in single qoutes for e.g.  'self' and 'unsafe-inline'.

The script-src  directive guards the loading and execution of JavaScript.

Assume a Content-Security-Policy header is set with the following policy:

The above declaration would allow this insert of script tags:

<!-- allowed by 'self' -->
<script src="/js/some-file.js"></script>
<!-- allowed by https://js.example.com -->
<script src="https://js.example.com/file.js"></script>

But blocks these insertion of script tags :

<script src="https://attacker.example.com/file.js"></script>

 Because We see attacker.example.com is not in the source list,

<script>
  runInlineScript();
</script>

Inline scripts are blocked by default (Unless ‘unsafe-inline’ or hash or nonce is used)

<button onClick="runInlineScript();">

The execution of all JS event handlers from inline HTML markup are blocked default, onclick, onload, onmouseover, onsubmit, etc.

<a href="javascript:runInlineScript();">JS will not run.</a>

There is no way to get javascript: to work when CSP is enabled except for unsafe-inline.

script-src: 'self'

<script>
                doSomething();
<script>

script-src: 'self' 'unsafe-inline'

script-src js-cdn.example.com 'nonce-rAnd0m1001';

<script nonce="rAnd0m1001">
                doSomething();
</script>

Content-Security-Policy: default-src 'none';script-src 'nonce-rAnd0m1002'

<script src="https://code.jquery.com/jquery-3.7.1.min.js" nonce="rAnd0m1002"></script>

<script>doSomething();</script>

script-src 'sha256-RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';