CSP unsafe setting detected by scanner on PA LSVPN gateway

[MingIkehara]

Hi All-

We have LSVPN configured and working.

However, a recent security scan shows that Content Security Policy (CSP ) issue with the gateway default login script in PA.  

It complains about:

script-src: self

style-src: self

Is there any suggestion on how this can be fixed?

Thank you!

[kiwi]

Hi @MingIkehara ,

As far as I know this is a false positive alert.

How to check the presence of Response Security Headers in PAN-OS
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HC9uCAG&lang=en_US%E2%80%A...

Connection: keep-alive
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src * data:; style-src 'self' 'unsafe-inline';

Please NOTE, because we use inline scripts for multiple purpose/locations, there is no easy way to remove the unsafe-inline tag from the CSP header.

There is a feature request planned for PAN-OS which has no ETA as of yet as it requires Source code change.

This vulnerability is not considered as a threat, and we have Feature Request ID: 19173.

By providing this Feature ID you can add your vote to it and check with your Account team when it is implemented.

Kind regards,

-Kim.