Security scan findings for Content-Security-Policy and credential transmission in VMware NSX

Products

• VMware NSX

Issue/Introduction

Security audits using tools such as Burp Suite may report vulnerabilities on the VMware NSX Manager appliance. These findings typically include insecure Content-Security-Policy (CSP) headers and unencrypted transmission of credentials at the application layer during authentication. This article provides the technical evaluation from engineering and the roadmap for remediation.

Symptoms: Technical security scans report the following vulnerabilities on the NSX Manager login interface:

• Credentials are transmitted to the server unencrypted in an application layer.
• Content-Security-Policy (CSP) header is missing or not set securely.
• Authentication payloads are visible as plain text within local browser developer tools during the POST request to login.jsp.

Environment

• VMware NSX 4.2.3.1

Cause

The identified findings are architectural within the specified software release. The CSP configuration in release 4.2.3.1 utilizes a bare-minimum policy, while the credential visibility is a result of application-layer handling prior to transport-layer encryption.

Resolution

Remediation for these findings depends on the specific vulnerability type:

Content-Security-Policy (CSP) Header The CSP header has been strengthened with nonce-based script control to provide defense-in-depth across all resource types.

1. The fix is targeted for release in NSX version 9.1.1 and 9.2.
2. Fixed in release 9.1.1, 9.2 and higher. 

Unencrypted Credential Transmission Engineering has determined that the confidentiality of credentials is maintained by transport-layer design. The following compensating controls mitigate the risk:

1. Ensure the environment enforces TLS 1.2 or higher with strong cryptographic cipher suites to encrypt the payload immediately upon submission.
2. Verify that HTTP Strict Transport Security (HSTS) is active to prevent protocol downgrade attacks.
3. Accept the residual risk based on client-side environment isolation, as payload visibility is confined to the local browser developer tools and is not intercepted on the network wire.