Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Content Security Policy - the panacea for XSS or placebo?

5b723186bd1e23af569bd623f193a2b9?s=47 oxdef
August 22, 2013
Programming
0
62

Content Security Policy - the panacea for XSS or placebo?

OWASP AppSec Research EU 2013

5b723186bd1e23af569bd623f193a2b9?s=128

oxdef

August 22, 2013
Tweet

More Decks by oxdef

See All by oxdef
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
6
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
8
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
140
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
110
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
20
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
140
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
65
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
9
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
69

Other Decks in Programming

See All in Programming
E0e036f89c14b3e59640318eedf9670b?s=48 bkuhlmann
1
130
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
0
700
746c5d84a717cf7f74822d248e06574e?s=48 nkmrh
3
710
977c74bb044a9d4fa90b305824eda390?s=48 olivergierke
3
400
E9e3472b8801ed21298ccefeecfaf429?s=48 takamichie
PRO
0
250
B8e501d93b98a553abf0b5cee0c33503?s=48 yasaichi
34
12k
A65c56fbce87057b9ee064122601d7b5?s=48 nirazo
4
860
9adb9a67e73d93190e1d07d077a9aae7?s=48 ykkc
4
290
1a1d418bdf51cbf8fce1317f6c80a907?s=48 satoshi0212
3
260
Eac0bf787b5279aca5e699ece096956e?s=48 inamiy
7
900
0620564f0125b8b3b7f4fe40c10b8b4e?s=48 tattn
2
200
E505897a79eede1a676f92740261e8f8?s=48 kubode
1
510

Featured

See All Featured
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
263
11k
B3ace07412a5178ea778e7eec161fc0a?s=48 jcasabona
10
740
C620790ae5bf5b50c245b2e0ef95f338?s=48 deanohume
294
28k
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
364
63k
1b75d89772b7eea1f6c89fbf362607d9?s=48 moore
128
22k
78b475797a14c84799063c7cd073962f?s=48 holman
294
130k
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
PRO
414
58k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
688
180k
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
110
11k
Ef32e0b1ac5082450dc8c1fca3a26b5c?s=48 cherdarchuk
77
270k
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
PRO
324
54k
Af6a12710770ad9a7cfd08c97efd40d3?s=48 pedronauck
654
120k

Transcript

  1. Taras Ivashchenko Information Security Officer CSP - the panacea for

    XSS or placebo?

  2. 2 $ whoami Information security officer at Yandex's product security

    team Web application security researcher Yet another security blogger www.oxdef.info

  3. XSS

  4. 4 XSS Why again about XSS?! Still one of the

    the most common web application security issues Ok, but please don't show me those alerts

  5. 5 Prevention Input validation Output escaping depending on context httponly

    session cookie Browser based solutions: IE filter, NoScript ?

  6. CSP

  7. 7 Content Security Policy Browser side mechanism to mitigate XSS

    attacks Source whitelists for client side resources of web application Content-Security-Policy HTTP header W3C Candidate Recommendation

  8. 8 HTML Template <h1>Test XSS page</h1> <h3>Hello, <i> {{ foo

    | safe }}!</i></h3> How it Works Demo URL http://127.0.0.1:5000/xss?foo= <img src="http://www.oxdef.info/exploit.png">

  9. 9 Without CSP

  10. 10 Content-Security-Policy: img-src 'self' CSP in Action

  11. 11 Policy Content-Security-Policy: default-src 'self'; script-src 'self' static.example.com Control JavaScript

    HTML <!doctype html><html><head> <meta charset="utf-8"> <script src="/js/jquery-1.10.2.js"></script> <script src="//evil.net/evil.js"></script>... console.log Refused to load the script 'http://evil.net/evil.js' because it violates...

  12. 12 Unsafe-inline and unsafe-eval • unsafe-inline allows: –Inline scripts and

    styles –onclick=”...” –javascrtipt: –You should not include it in the policy! • unsafe-eval allows: –eval() –new Function –setTimeout, setInterval with string as a first argument –You should not include it in the policy!

  13. 13 Other Directives media-src – audio and video object-src -

    plugin objects (e.g. Flash) frame-src – iframe sources font-src – font files connect-src – XMLHttpRequest, WebSockets, EventSource

  14. 14 { "csp-report": { "violated-directive": "img-src data: ... *.example.com", "referrer":

    "", "blocked-uri": "https://static.doubleclick.net", "document-uri": "https://example.com/foo", "original-policy": "default-src ...; report-uri csp.php" } } Reporting Content-Security-Policy-Report-Only: ...; report-uri csp.php Policy Log contents

  15. 15 Browser Support Content-Security-Policy 25+ 23+ 1.7+ X-Content-Security-Policy 4 -

    22 10 (sandbox) X-WebKit-CSP 14 - 25 5.1+ Mobile browsers: 7.0+ 28+ 23+

  16. 16 Bypass Manipulating HTTP response headers Implementation bugs: MFSA 2012-36:

    Content Security Policy inline-script bypass JSONP XSS without JS

  17. 17 <!doctype html> <html> <head> <meta charset="utf-8"> <script src="/js/jquery.min.js"></script> </head>

    <body> <script nonce="Nc3n83cnSAd"> // Some inline code here </script> See in the Next Version: nonce-source Content-Security-Policy: script-src 'self' nonce-Nc3n83cnSAd Policy HTML Code

  18. Case-study

  19. 19 About the Service One of the most popular mail

    services in Russia Over 12 million email messages daily Lots of client side code and hosts to communicate with

  20. 20 CSP Tester Extension for Chromium based browsers Simple and

    Advanced modes Content-Security-Policy and X-WebKit- CSP headers Help links for directives https://github.com/oxdef/csp-tester

  21. 21 CSP Tester in action

  22. 22 The Plan 1.Test it on the corporate mail 2.It's

    ok - let's try it on production in Report- Only mode 3.Analyze tons of logs ;-( 4.Fix bugs and improve the policy 5.Switch to block mode 6.Profit! :-)

  23. 23 Changes in service Try to remove all inline code

  24. 24 Log Analysis awk, grep, sort,head for gigabytes of logs?

    Yes, but we can do it in more complex way with help of Python Charts for directives and blocked URIs

  25. 25 Problems Browser implementations differ 3rd party JS libraries Inline

    styles in HTML letters Browser extensions What is that *** external code doing in our DOM?

  26. 26 From Report-Only to Block mode Fix bugs from CSP

    logs Use only standard CSP HTTP header Allow browser extensions unsafe-inline for style-src unsafe-eval for script-src

  27. 27 Tips Teach your front-end developers Add CSP as security

    requirement for new products Don't forget about mobile versions! Research your core front-end components to support CSP Assign developer responsible for CSP

  28. 28 CSP Based IDS Magic XSS XSS XSS Test &

    Fix

  29. 29 Conclusion CSP is not a panacea but it's a

    good «yet another level» to protect your users against XSS attacks

  30. 30 To be continued ;-)

  31. Taras Ivashchenko Information Security Officer oxdef@yandex-team.ru http://company.yandex.com/security Thanks