How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal?

ahan — Wed, 21 Aug 2024 03:35:31 GMT

Hi everyone,

We’re using Checkpoint's Mobile Access Portal, and during a security scan with Panoray, we identified potential vulnerabilities related to the default CSP configuration:

Checkpoint Gateway Version : R81.10

Content-Security-Policy: default-src 'self' wss: localhost:14186 www.google.com www.gstatic.com 'unsafe-inline' 'unsafe-eval'; img-src https: 'self' data:; font-src 'self' data: fonts.gstatic.com

The detected issues include:
1. The use of 'unsafe-inline' and `'unsafe-eval'`, which could increase the risk of XSS attacks.
2. The default-src directive allowing resources from www.google.com and `www.gstatic.com`, potentially broadening the attack surface.
3. Allowing data: in `img-src`, which may introduce some risk, albeit lower.
4. Allowing data: in `font-src`, which could also pose risks, and might be better managed by restricting resource sources.

Since these vulnerabilities were flagged by Panoray, we’re looking for recommendations on how to mitigate these risks within the default configuration. Specifically, how can we safely address the use of 'unsafe-inline' and `'unsafe-eval'`, and what are the best practices for securely managing external resource sources?

Any advice or configuration recommendations would be greatly appreciated.

Thanks in advance!

Re: How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal?

_Val_ — Wed, 21 Aug 2024 08:29:46 GMT

Please review sk178514

topic Re: How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal? in SASE and Remote Access

How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal?

Re: How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal?