CVE-2023-46098

Vulnerability identification processes can surface permissive policy misconfigurations.

Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.

Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.

Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.

Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.

Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.

A.8.26 only requires that security requirements (including resilience against attacks such as injections) be identified and specified during development or acquisition; it does not itself enforce, implement, or configure any cross-domain policy, CSP, or domain whitelist that would stop exploitation of a permissive policy allowing untrusted domains.

A.8.27 mandates security-by-design, defense-in-depth, least-privilege, assume-breach, distrust-external-input, and explicit review against known attack patterns (including permissive cross-domain policies); this stops exploitation in many but not all cases (e.g. when the policy is supplied by a third-party component or when the review misses a novel untrusted domain).

Secure coding practices require proper configuration of CSP and cross-domain policies to avoid untrusted domains.