How to Mitigate Multiple Security Risks in Default CSP Configuration for Mobile Access Portal?

[ahan]

Hi everyone,

We’re using Checkpoint's Mobile Access Portal, and during a security scan with Panoray, we identified potential vulnerabilities related to the default CSP configuration:

Checkpoint Gateway Version : R81.10

Content-Security-Policy: default-src 'self' wss: localhost:14186 www.google.com www.gstatic.com 'unsafe-inline' 'unsafe-eval'; img-src https: 'self' data:; font-src 'self' data: fonts.gstatic.com

The detected issues include:
1. The use of 'unsafe-inline' and `'unsafe-eval'`, which could increase the risk of XSS attacks.
2. The default-src directive allowing resources from www.google.com and `www.gstatic.com`, potentially broadening the attack surface.
3. Allowing data: in `img-src`, which may introduce some risk, albeit lower.
4. Allowing data: in `font-src`, which could also pose risks, and might be better managed by restricting resource sources.

Since these vulnerabilities were flagged by Panoray, we’re looking for recommendations on how to mitigate these risks within the default configuration. Specifically, how can we safely address the use of 'unsafe-inline' and `'unsafe-eval'`, and what are the best practices for securely managing external resource sources?

Any advice or configuration recommendations would be greatly appreciated.

Thanks in advance!

[_Val_]

Please review sk178514