Content Security Policy (CSP) implemented with unsafe-eval

Content Security Policy is a security standard. It was introduced to protect from cross-site scripting and other injection attacks. This is achieved by restricting data access from different sources. Content Security Policy is the second layer of protection from Cross-site Scripting and related attacks. This application uses an Unsafe Content Security Policy Directive unsafe-eval. This vulnerability allows the use of string evaluation functions like eval. This may lead to the attacker to bypass Content Security Policy and exploits a Cross-site Scripting vulnerability successfully.

Example

        Content-Security-Policy:
            default-src 'self';
            script-src 'self' https://code.jquery.com;

    

Impact

This vulnerability leads to cross-site scripting and related attacks.

Mitigation / Precaution

Beagle recommends the following impacts:-

• Set proper Content Security Policy
• Remove unsafe eval from Content Security Policy Directive

Written by

Rejah Rehim

Co-founder, Director

Rejah brings more than 12 years of industry experience in Information Technology. He is a fervent security enthusiast and serves as a Project Leader at OWASP Foundation, and Commander (Hon.) at Kerala Police. He has authored two books titled “Effective Python Penetration Testing” and “Python Penetration Testing Cookbook” and is the creator of 9 Mozilla add-ons.