CME-905
Content Security Policy (CSP) Headers
Description
Browser-enforced HTTP header policy that restricts script sources, prevents inline execution, and blocks mixed content. Defense-in-depth against stored/reflected XSS that catches output encoding failures. CSP's frame-ancestors directive also mitigates clickjacking.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | CSP script-src directive restricts script execution to enumerated origins; injected inline scripts are blocked by the browser's enforcement engine regardless of payload encoding or obfuscation |
CWE Relationships
Verification
Verify CSP header is present with effective script restrictions
$ curl -sI http://<target>/ | grep -i content-security-policy
# Expected: Content-Security-Policy:
# Expected: Content-Security-Policy:
Platform: any
$ curl -sI http://<target>/ | grep -i content-security-policy | grep -ic 'unsafe-inline'
# Expected: 0
# Expected: 0
Platform: any
$ curl -sI http://<target>/ | grep -i content-security-policy | grep -ic 'unsafe-eval'
# Expected: 0
# Expected: 0
Platform: any
Remediation
linux
Content Security Policy header via nginx drop-in configuration
printf 'add_header Content-Security-Policy "default-src '\''self'\''; script-src '\''self'\''; style-src '\''self'\''; img-src '\''self'\'' data:; font-src '\''self'\''; frame-ancestors '\''self'\''; base-uri '\''self'\''; form-action '\''self'\''" always;\n' > /etc/nginx/conf.d/cme-905-csp.conf
nginx -t
systemctl reload nginx
linux
Content Security Policy header via Apache httpd drop-in configuration
printf '<IfModule mod_headers.c>\n Header always set Content-Security-Policy "default-src '\''self'\''; script-src '\''self'\''; style-src '\''self'\''; img-src '\''self'\'' data:; font-src '\''self'\''; frame-ancestors '\''self'\''; base-uri '\''self'\''; form-action '\''self'\''"\n</IfModule>\n' > /etc/httpd/conf.d/cme-905-csp.conf
httpd -t || apachectl configtest
systemctl reload httpd