CSP unsafe setting detected by scanner on PA LSVPN gateway

MingIkehara — Fri, 15 Mar 2024 17:57:30 GMT

Hi All-

We have LSVPN configured and working.

However, a recent security scan shows that Content Security Policy (CSP ) issue with the gateway default login script in PA.

It complains about:

script-src: self

style-src: self

Is there any suggestion on how this can be fixed?

Thank you!

Re: CSP unsafe setting detected by scanner on PA LSVPN gateway

kiwi — Tue, 08 Apr 2025 15:58:21 GMT

Hi @MingIkehara ,

As far as I know this is a false positive alert.

How to check the presence of Response Security Headers in PAN-OS
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HC9uCAG&lang=en_US%E2%80%A9

Connection: keep-alive
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src * data:; style-src 'self' 'unsafe-inline';

Please NOTE, because we use inline scripts for multiple purpose/locations, there is no easy way to remove the unsafe-inline tag from the CSP header.

There is a feature request planned for PAN-OS which has no ETA as of yet as it requires Source code change.

This vulnerability is not considered as a threat, and we have Feature Request ID: 19173.

--EDIT: Updated FR ID: NSFR-I-28198 --

By providing this Feature ID you can add your vote to it and check with your Account team when it is implemented.

Kind regards,

-Kim.

topic CSP unsafe setting detected by scanner on PA LSVPN gateway in GlobalProtect Discussions

CSP unsafe setting detected by scanner on PA LSVPN gateway

Re: CSP unsafe setting detected by scanner on PA LSVPN gateway