1

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an iframe.

During a recent scan by our security vendor, they have identified a few high risk vulnerabilities within the 3rd party application. The vulnerabilities are around old versions of jquery and bootstrap being used by the 3rd party application.

https://snyk.io/vuln/npm:jquery@1.9.1

https://snyk.io/vuln/npm:bootstrap@3.3.6

We've notified the 3rd party vendor about the vulnerabilities, but they won't sign up to fix the issues until much later than we need a resolution. In the interim, are there any recommendations on what we can do to mitigate/resolve these issues? I'm pretty new when it comes to this sort of stuff, but here are some of the thoughts we've had so far.

  • Implement a content security policy on the hosted 3rd party application. Would this completely eliminate the vulnerability? Would the policy exist on the primary application, or would we have to configure the 3rd party application? Or both?
  • Modify the hosted application. Not ideal, but I think the affected js libraries are deployed with the application.
  • Host the application behind something other than an iframe (Citrix?). Not sure what exactly this entails, and likely brings in a whole other set of security implications.
5
  • "Implement a content security policy on the hosted 3rd party application." - a strict CSP can help with security but might break the application. A lax CSP might keep the application working but will also keep it insecure. Thus if CSP is a possible way depends a lot on the specific application. "Modify the hosted application" - might break the application or might work. Again, depends on the application. Feb 19 at 16:15
  • Please explain little bit about is it used by external users or internal users? Don't you have agreement with vendor?
    – Infra
    Feb 19 at 18:23
  • @SteffenUllrich if we were to modify the application, we'd ensure it wouldn't break. Obviously that increases the cost of the solution.
    – almisson
    Feb 19 at 21:19
  • @Infra The application is used by external users. We do have an agreement with the vendor, but we can't dictate their roadmap. We've expressed our concern, but none of their other clients have reported the issue.
    – almisson
    Feb 19 at 21:20
  • @almisson: I'm pretty sure that your goal is not to break the application. Only, a simple upgrade of the library might cause the application to break if it it relies on a specific behavior the new version of the library no longer has. Similar a strict CSP with inline eval disabled might cause the application to break if it actually needs inline eval - and without inline eval disabled the CSP might not be sufficient to protect against XSS. Feb 19 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.