Medium Vulnerability Description
The server does not include a Content-Security-Policy header in HTTP(S) responses.
Impact
Content Security Policy is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. To use CSP, the developer writes a set of rules to govern which servers an app can open connections to, limit the types of content it can download from those servers, and restrict the use of dangerous features like inline scripts and the eval function.
Verification and Attack Information
Praetorian identified this issue through a manual application walkthrough by reviewing HTTP headers. While doing so, Praetorian noted that Content-Security-Policy header was not included in server response headers.
Recommendation
Best practices for web applications suggest that servers should specify a Content Security Policy (CSP) to whitelist the actions that their users' browsers are allowed to take.
References
https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
http://www.html5rocks.com/en/tutorials/security/content-security-policy/
| Field | Original Value | New Value |
|---|---|---|
| Rank | Ranked higher |
| Sprint | ST Sprint 2 [ 4 ] |
| Rank | Ranked lower |
| Assignee | Niteen Surwase [ niteen.surwase ] |
| Status | New Request [ 10029 ] | Pending for Approval [ 10002 ] |
| Status | Pending for Approval [ 10002 ] | Approved for Development [ 10003 ] |
| Status | Approved for Development [ 10003 ] | In Development [ 10007 ] |
| Assignee | Niteen Surwase [ niteen.surwase ] | Amit Gude [ amitg ] |
| Status | In Development [ 10007 ] | Local Testing [ 10200 ] |
| Assignee | Amit Gude [ amitg ] | Zeeshan Chishty [ zeeshan.chishty ] |
Zeeshan Chishty (Inactive)
made changes -
| Status | Local Testing [ 10200 ] | Reopen in Local [ 10018 ] |
| Status | Reopen in Local [ 10018 ] | In Development [ 10007 ] |
| Status | In Development [ 10007 ] | Local Testing [ 10200 ] |
| Issue Importance | Must Have [ 11800 ] |
Zeeshan Chishty (Inactive)
made changes -
| Assignee | Zeeshan Chishty [ zeeshan.chishty ] | Niteen Surwase [ niteen.surwase ] |
Zeeshan Chishty (Inactive)
made changes -
| Labels | Security |
| Assignee | Niteen Surwase [ niteen.surwase ] | Zeeshan Chishty [ zeeshan.chishty ] |
Zeeshan Chishty (Inactive)
made changes -
| Status | Local Testing [ 10200 ] | Pending for Stage Approval [ 10300 ] |
Zeeshan Chishty (Inactive)
made changes -
| Assignee | Zeeshan Chishty [ zeeshan.chishty ] | Niteen Surwase [ niteen.surwase ] |
| Item State | Parent values: Development(10200)Level 1 values: In Analysis(10204) | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) |
| Status | Pending for Stage Approval [ 10300 ] | Approved for Stage [ 10030 ] |
| Item State | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) |
| Assignee | Niteen Surwase [ niteen.surwase ] | Zeeshan Chishty [ zeeshan.chishty ] |
Zeeshan Chishty (Inactive)
made changes -
| Assignee | Zeeshan Chishty [ zeeshan.chishty ] | Vijayendra Shinde [ ID10506 ] |
Zeeshan Chishty (Inactive)
made changes -
| Status | Approved for Stage [ 10030 ] | Stage Testing [ 10201 ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) | Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217) |
| Assignee | Vijayendra Shinde [ ID10506 ] | Zeeshan Chishty [ zeeshan.chishty ] |
| Developer | Niteen Surwase [ niteen.surwase ] |
Zeeshan Chishty (Inactive)
made changes -
| Assignee | Zeeshan Chishty [ zeeshan.chishty ] | Rakesh Roy [ rakeshr ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217) | Parent values: Stage QA(10202)Level 1 values: In Testing(10214) |
| Assignee | Rakesh Roy [ rakeshr ] | Deepali Tidke [ deepalit ] |
| Assignee | Deepali Tidke [ deepalit ] | Kunal Kedari [ kunal.kedari ] |
Kunal Kedari (Inactive)
made changes -
| Assignee | Kunal Kedari [ kunal.kedari ] | Niteen Surwase [ niteen.surwase ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: In Testing(10214) | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) |
| Status | Stage Testing [ 10201 ] | Reopen in Stage [ 10023 ] |
| Status | Reopen in Stage [ 10023 ] | In Development [ 10007 ] |
| Status | In Development [ 10007 ] | Local Testing [ 10200 ] |
| Status | Local Testing [ 10200 ] | Pending for Stage Approval [ 10300 ] |
| Status | Pending for Stage Approval [ 10300 ] | Approved for Stage [ 10030 ] |
| Assignee | Niteen Surwase [ niteen.surwase ] | Rakesh Roy [ rakeshr ] |
| Stage Due Date | 22/Jun/16 [ 2016-06-22 ] |
| Assignee | Rakesh Roy [ rakeshr ] | Kunal Kedari [ kunal.kedari ] |
Kunal Kedari (Inactive)
made changes -
| Assignee | Kunal Kedari [ kunal.kedari ] | Niteen Surwase [ niteen.surwase ] |
| Item State | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) | Parent values: LB QA(10201)Level 1 values: On Hold(10211) |
| Item State | Parent values: LB QA(10201)Level 1 values: On Hold(10211) | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) |
| Item State | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) |
Gokul Sonawane (Inactive)
made changes -
| Item State | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) | Parent values: Stage QA(10202) |
Gokul Sonawane (Inactive)
made changes -
| Item State | Parent values: Stage QA(10202) | Parent values: LB QA(10201) |
| Item State | Parent values: LB QA(10201) | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) |
| Assignee | Niteen Surwase [ niteen.surwase ] | Rakesh Roy [ rakeshr ] |
| Assignee | Rakesh Roy [ rakeshr ] | Prasad Pise [ prasadp ] |
| Status | Approved for Stage [ 10030 ] | Stage Testing [ 10201 ] |
| Component/s | BenAdmin [ 10100 ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) | Parent values: Production Complete(10222)Level 1 values: Closed(10223) |
| Status | Stage Testing [ 10201 ] | Pending for Production Approval [ 10301 ] |
| Status | Pending for Production Approval [ 10301 ] | Approved for production [ 10034 ] |
| Status | Approved for production [ 10034 ] | Production Testing [ 10202 ] |
| Resolution | Fixed [ 1 ] | |
| Status | Production Testing [ 10202 ] | Production Complete [ 10028 ] |
| Status | Production Complete [ 10028 ] | Closed [ 6 ] |
| Link | This issue relates to DEV-13718 [ DEV-13718 ] |