Pro Yearly is on sale from $80 to $50! »

Content Security Policy - the panacea for XSS or placebo?

5b723186bd1e23af569bd623f193a2b9?s=47 oxdef
August 22, 2013
Programming
0
19

Content Security Policy - the panacea for XSS or placebo?

OWASP AppSec Research EU 2013

5b723186bd1e23af569bd623f193a2b9?s=128

oxdef

August 22, 2013
Tweet

More Decks by oxdef

See All by oxdef
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
69
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
43
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
11
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
53
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
22
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
7
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
25
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
1
38
5b723186bd1e23af569bd623f193a2b9?s=48 oxdef
0
10

Other Decks in Programming

See All in Programming
42a6a049ac8f5265f31858a9509217fb?s=48 uhooi
0
250
52711e2157a6fed933b0361cc06a6953?s=48 marcelgsantos
1
240
3f2e97dc4e6a5daaf1cb8a406c533176?s=48 knqyf263
2
590
1405a601755e5fcbfdc93a2560368bb1?s=48 freddi
0
220
64c1a3841da6d254ac11d9d842e04ce4?s=48 dalinaum
1
510
7edddae207b212e5e035133d9eb10b82?s=48 russhwolf
1
170
75cf8176bf14811428f77d8fe737f0d5?s=48 konstantin_diener
0
190
79fc33e55cacc42beef647541de24d58?s=48 yasuakiomokawa
2
480
B8811aa702d3f891ad13385f2ef99383?s=48 yotubarail
0
120
D65e990ab4df0d0a75c3b0ae5d036bc5?s=48 martinlippert
1
210
1dfa2bb34977b1db41d0d46d4505183f?s=48 osuke
2
310
6170c1d1970baf2a36a9ae2955e47ff3?s=48 jimhester
0
260

Featured

See All Featured
E13c31390e0369fcd5972292ce0e7b92?s=48 jnunemaker
PRO
40
4.5k
245cee81a9c424266e5e401d844ea881?s=48 lara
590
60k
5f83ef806155b403c3393160ce51f955?s=48 jlugia
216
16k
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
10
920
44b54d2ffcb7857004071cc6795dde11?s=48 cassininazir
346
20k
Aebc2d07a50011e2a30d38435fde564a?s=48 jrom
114
7k
761be20b5ebd271008bcee1244fc5b52?s=48 matthewcrist
72
7.4k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
401
20k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
295
39k
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
9
1.2k
0c6fd6a08d0f898159cda7cafcacf07f?s=48 afnizarnur
176
14k
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
258
11k

Transcript

  1. Taras Ivashchenko Information Security Officer CSP - the panacea for

    XSS or placebo?

  2. 2 $ whoami Information security officer at Yandex's product security

    team Web application security researcher Yet another security blogger www.oxdef.info

  3. XSS

  4. 4 XSS Why again about XSS?! Still one of the

    the most common web application security issues Ok, but please don't show me those alerts

  5. 5 Prevention Input validation Output escaping depending on context httponly

    session cookie Browser based solutions: IE filter, NoScript ?

  6. CSP

  7. 7 Content Security Policy Browser side mechanism to mitigate XSS

    attacks Source whitelists for client side resources of web application Content-Security-Policy HTTP header W3C Candidate Recommendation

  8. 8 HTML Template <h1>Test XSS page</h1> <h3>Hello, <i> {{ foo

    | safe }}!</i></h3> How it Works Demo URL http://127.0.0.1:5000/xss?foo= <img src="http://www.oxdef.info/exploit.png">

  9. 9 Without CSP

  10. 10 Content-Security-Policy: img-src 'self' CSP in Action

  11. 11 Policy Content-Security-Policy: default-src 'self'; script-src 'self' static.example.com Control JavaScript

    HTML <!doctype html><html><head> <meta charset="utf-8"> <script src="/js/jquery-1.10.2.js"></script> <script src="//evil.net/evil.js"></script>... console.log Refused to load the script 'http://evil.net/evil.js' because it violates...

  12. 12 Unsafe-inline and unsafe-eval • unsafe-inline allows: –Inline scripts and

    styles –onclick=”...” –javascrtipt: –You should not include it in the policy! • unsafe-eval allows: –eval() –new Function –setTimeout, setInterval with string as a first argument –You should not include it in the policy!

  13. 13 Other Directives media-src – audio and video object-src -

    plugin objects (e.g. Flash) frame-src – iframe sources font-src – font files connect-src – XMLHttpRequest, WebSockets, EventSource

  14. 14 { "csp-report": { "violated-directive": "img-src data: ... *.example.com", "referrer":

    "", "blocked-uri": "https://static.doubleclick.net", "document-uri": "https://example.com/foo", "original-policy": "default-src ...; report-uri csp.php" } } Reporting Content-Security-Policy-Report-Only: ...; report-uri csp.php Policy Log contents

  15. 15 Browser Support Content-Security-Policy 25+ 23+ 1.7+ X-Content-Security-Policy 4 -

    22 10 (sandbox) X-WebKit-CSP 14 - 25 5.1+ Mobile browsers: 7.0+ 28+ 23+

  16. 16 Bypass Manipulating HTTP response headers Implementation bugs: MFSA 2012-36:

    Content Security Policy inline-script bypass JSONP XSS without JS

  17. 17 <!doctype html> <html> <head> <meta charset="utf-8"> <script src="/js/jquery.min.js"></script> </head>

    <body> <script nonce="Nc3n83cnSAd"> // Some inline code here </script> See in the Next Version: nonce-source Content-Security-Policy: script-src 'self' nonce-Nc3n83cnSAd Policy HTML Code

  18. Case-study

  19. 19 About the Service One of the most popular mail

    services in Russia Over 12 million email messages daily Lots of client side code and hosts to communicate with

  20. 20 CSP Tester Extension for Chromium based browsers Simple and

    Advanced modes Content-Security-Policy and X-WebKit- CSP headers Help links for directives https://github.com/oxdef/csp-tester

  21. 21 CSP Tester in action

  22. 22 The Plan 1.Test it on the corporate mail 2.It's

    ok - let's try it on production in Report- Only mode 3.Analyze tons of logs ;-( 4.Fix bugs and improve the policy 5.Switch to block mode 6.Profit! :-)

  23. 23 Changes in service Try to remove all inline code

  24. 24 Log Analysis awk, grep, sort,head for gigabytes of logs?

    Yes, but we can do it in more complex way with help of Python Charts for directives and blocked URIs

  25. 25 Problems Browser implementations differ 3rd party JS libraries Inline

    styles in HTML letters Browser extensions What is that *** external code doing in our DOM?

  26. 26 From Report-Only to Block mode Fix bugs from CSP

    logs Use only standard CSP HTTP header Allow browser extensions unsafe-inline for style-src unsafe-eval for script-src

  27. 27 Tips Teach your front-end developers Add CSP as security

    requirement for new products Don't forget about mobile versions! Research your core front-end components to support CSP Assign developer responsible for CSP

  28. 28 CSP Based IDS Magic XSS XSS XSS Test &

    Fix

  29. 29 Conclusion CSP is not a panacea but it's a

    good «yet another level» to protect your users against XSS attacks

  30. 30 To be continued ;-)

  31. Taras Ivashchenko Information Security Officer oxdef@yandex-team.ru http://company.yandex.com/security Thanks