Bug Type
Security
Reproduction steps
- Kali Linux
- ProxyZap
- The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.
- Open Burp
- Proxy
- Burp is testing CLICKJAKE
- Success...
Actual result
CWE 2021
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Expected result
The use of frames-ancestors of the Content Security Policy, a kind of successor to the X-Frame-Options header, which prohibits the use of frames in other dangerous viruses. Another way to protect against clickjacking is to simply have code that uses the highest level UI frame.
Suggested Severity
Medium
Device
Desktop (please complete the following information):
- Windows/Kali Linux
- Edge/Chrome
Additional Context
No response
Bug Type
Security
Reproduction steps
Actual result
CWE 2021
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Expected result
The use of frames-ancestors of the Content Security Policy, a kind of successor to the X-Frame-Options header, which prohibits the use of frames in other dangerous viruses. Another way to protect against clickjacking is to simply have code that uses the highest level UI frame.
Suggested Severity
Medium
Device
Desktop (please complete the following information):
Additional Context
No response