CVE-2015-3750

Vulnerability

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 0.8, and in iOS before 8.4.1, fails to enforce HTTP Strict Transport Security (HSTS) for Content Security Policy (CSP) report requests [1],[2]. When a site sends CSP violation reports over HTTP, the lack of HSTS integration allows the reports to be transmitted in the clear instead of over HTTPS, even if the original page was loaded over HTTPS with an HSTS policy in place.

Exploitation

A man-in-the-middle attacker positioned on the network between the user and the server can sniff the CSP report request, capturing potentially sensitive data (such as partial page content or URIs) that the site includes in the report. The attacker can also spoof a report by modifying the client-to-server data stream, injecting a fake CSP violation report to the site's report endpoint.

Impact

Information disclosure (confidentiality) and integrity loss. The attacker obtains CSP report contents that may contain sensitive data from the protected page, and can inject false violation reports, which could lead to incorrect security monitoring, false alarms, or other downstream actions by the server based on report data.

Mitigation

Apple addressed the issue in Safari 6.2.8, 7.1.8, and 8.0.8, and in iOS 8.4.1 [1],[2]. Users should update their browser or operating system to the patched versions. No workaround is described for unpatched systems.