Rule ID
SV-286761r1294279_rule
Version
V1R1
CCIs
The Horizon Connection Server CSP feature mitigates a broad class of content injection vulnerabilities including cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. The Connection Server has default CSP directives that block XSS attacks, enable x-frame restrictions, and more. If the default configurations are overridden, the protections may be disabled even though the CSP itself is still enabled. This default policy must be validated and maintained over time.
If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable. 1. On the Horizon Connection Server, navigate to: <install_directory>\sslgateway\conf Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation. 2. Verify the file "locked.properties" exists. If the "locked.properties" file does not exist, this is a finding. 3. Open "locked.properties" in a text editor. If any settings containing the text "content-security-policy" are present, this is a finding.
If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable. 1. On the Horizon Connection Server, navigate to: <install_directory>\sslgateway\conf 2. Open the "locked.properties" file in a text editor or create it if it does not exist. 3. Open the "locked.properties" file in a text editor. Find and remove any settings matching the following pattern, if present: content-security-policy* 4. Save and close the file. 5. Restart the Omnissa Horizon Connection Server service for changes to take effect.