We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an iframe.
During a recent scan by our security vendor, they have identified a few high risk vulnerabilities within the 3rd party application. The vulnerabilities are around old versions of jquery and bootstrap being used by the 3rd party application.
We've notified the 3rd party vendor about the vulnerabilities, but they won't sign up to fix the issues until much later than we need a resolution. In the interim, are there any recommendations on what we can do to mitigate/resolve these issues? I'm pretty new when it comes to this sort of stuff, but here are some of the thoughts we've had so far.
- Implement a content security policy on the hosted 3rd party application. Would this completely eliminate the vulnerability? Would the policy exist on the primary application, or would we have to configure the 3rd party application? Or both?
- Modify the hosted application. Not ideal, but I think the affected js libraries are deployed with the application.
- Host the application behind something other than an iframe (Citrix?). Not sure what exactly this entails, and likely brings in a whole other set of security implications.