SharePoint: HTML pages

🚨 The Signal: SharePoint now supports rendering custom HTML pages, including those generated by Copilot. This introduces new avenues for content presentation but also potential vectors for malicious code injection and data exfiltration if not properly governed.

The Impact

SharePoint administrators and security teams are affected by new risks related to untrusted HTML content, potentially leading to cross-site scripting (XSS) or data exposure.

  • SharePoint Admins: Must review and update content governance policies for HTML pages.
  • Security Teams: Need to assess and mitigate risks from user-generated or uploaded HTML, including XSS.
  • Content Creators: Gain flexibility but must be aware of security implications when using custom HTML.
  • Compliance Officers: Must ensure HTML content adheres to data handling and integrity standards.

The Action

  1. Review and update SharePoint tenant-wide content security policies to explicitly address HTML page creation and upload.
  2. Implement or reinforce content moderation workflows for HTML pages, especially those from external sources or Copilot.
  3. Educate content creators on secure HTML practices and the risks of embedding untrusted code.
  4. Monitor SharePoint audit logs for unusual activity related to HTML page creation or modification.
  5. Consider implementing Content Security Policy (CSP) headers if SharePoint allows for customisation at a granular level for HTML pages.

Domain: SharePoint · Impact: high · Workload: SharePoint · Essential Eight: User Application Hardening · ISM: ISM-1412, ISM-1485, ISM-1486, ISM-1542, ISM-1585, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860