Content Security Policy (CSP) issue or bypass

[stmusr]

Dear 3CX Community,

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Description​

A vulnerability has been detected on https://xxxxxxxxxxxxxx:5001

Some issues have been identified on the Content Security Policy (CSP) of this service.

Directive script-src with value 'self'

'self' can be problematic if you host JSONP, AngularJS or user uploaded files.

Directive script-src with value https://downloads-global.3cx.com

No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.

Directive script-src with value https://127.0.0.1:32018

No bypass found; make sure that this URL doesn't serve JSONP replies or Angular libraries.

Directive script-src with value https://127.0.0.1:32018

script-src directive allows localhost as source. Please make sure to remove this in production environments.

Directive connect-src with value https://127.0.0.1:32018

connect-src directive allows localhost as source. Please make sure to remove this in production environments.

Steps to reproduce​

1. Send the following request:

GET / HTTP/1.1
Host: xxxxxxxxxxxxxxxxx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 artiacker_genesis
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

​

Impact​

The lack of CSP may allow an attacker to exploit XSS vulnerabilities with ease. If the attacker is able to inject malicious scripts or code into the webpage, they can gain access to sensitive information or take control of the website.

Suggested mitigations​

The following mitigations can help prevent CSP bypass or issues:

• Check the described issues and verify exploitability. If the issues are exploitable, fix them.
• Remove 'unsafe-inline' and 'unsafe-eval' from the script-src directive.
• If the website hosts JSONP, AngularJS, or user-uploaded files, use a Content Delivery Network (CDN) or subdomain to host the files.
• Restrict object-src to 'none' only.

By following these mitigations, the vulnerability can be reduced significantly. It is important to keep the CSP up-to-date and to regularly check for any issues or vulnerabilities.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Can you check this problem and give feedback?

Thank you.

Regards.

 

[Pierre_3CX]

Hello,
Thanks for the report,
Although it looks like you got this from the Google CSP Evaluator which report these as "possible medium severity finding" when evaluating our default CSP header.

These highly depends of the web application and need to be put in context.

In case of the 3cx webclient there are additional controls to ensure that user inputs are properly escaped and user uploads not embeddable, so the risk of XSS attacks is thus mitigated. As such this can be reranked as a false positive finding.

 

[stmusr]

Dear Pierre,

Thank you for your reply.

Let me just ask one question.

What will be the impact on 3CX if you apply this fix below?

"Remove 'unsafe-inline' and 'unsafe-eval' from the script-src directive."​

Thank you.

Regards.

 

[Pierre_3CX]

Hello @stmusr ,
In fact there is no 'unsafe-inline' and 'unsafe-eval' in the script-src directive - I checked the CSP headers on both v18 U9 and v20 Final and there is no such entry, which version of the 3cx phone system are you scanning?

The only 'unsafe-inline' entry can be found under the style-src directive, which relates to inline CSS stylesheets but that's something different.