How secure is using https://*.domain.com as a value in a Content Security Policy?

Question

Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet.

The CSP for that website is Content-Security-Policy: default-src 'self' https://*.example.com

All internal servers are also on the same domain example.com. For example: internal website corporate.example.com hosts a community for internal employees. This service is internal and cannot be accessed publicly. However, it is accessible by app.example.com through https- there are no firewall rules preventing https traffic between the two.

Let's assume a threat actor comes to know that there is an internal web service named corporate.example.com.Can the threat actor then inject code on app.example.com to indirectly access images from corporate.example.com? For example:

<img src="https://corporate.example.com/profilepicture.jpg">

The example in this case is an image but could they access any resource including scripts and other objects hosted on the internal server through this method of injection? Perhaps this is not possible and I'm missing something very foundational.

If this is possible, what are some ways to prevent such a vulnerability?

Answer 1

Can the threat actor then inject code on app.example.com to indirectly access images from corporate.example.com?

Can the threat actor inject any code in the public site - maybe, nothing shown in the question prevents it but nothing explicitly allows it either. Can app.example.com be made to access corporate.example.com - yes, the site has access, but ...

<img src="https://corporate.example.com/profilepicture.jpg">

This code fragment in app.example.com will not make app.example.com access corporate.example.com. It is instead an instruction to the client (browser) that it should access corporate.example.com directly. If the client can do this depends on the position of the client.

If the client is external to the company it should based on your description not be able to access corporate.example.com, so including the image would fail.

Note that it would be different if the public site would provide some functionality to proxy internal resources or to include these directly into the site, i.e. something like this

 <img src="https://app.example.com/proxy/corporate.example.com/profilepicture.jpg">

In this case the internal resource would be retrieved internally by the public site and then served to the client, instead of retrieved by the client directly. Since the public site has access to the internal site, this would provide access to the internal resource to the external client.