hi! Test domain : https://nextcloud.com Summary ====== https://nextcloud.com/ A clickjacking vulnerability was detected because the X-Frame-Options Header was not set.More Steps To Reproduce == 1. Create a new HTML file 2. Include the following payload ``` Trusted web page

https://nextcloud.com

``` 3. Open document in browser Impact === An attacker could trick the user into sending a malicious link, and then the user could click on the image to cause potential harm. Solution === The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP (Content-Security-Policy) header. ``` X-Frame-Options : DENY X-Frame-Options : SAMEORIGIN , ALLOW-FROM allows X-Frame-Options : ALLOW FROM https:// allow website address ``` ```

httpHeaderSecurity

org.apache.catalina.filters.HttpHeaderSecurityFilter

antiClickJackingOption

SAMEORIGIN

httpHeaderSecurity

*.do

``` References == https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options https://www.owasp.org/index.php/Clickjacking https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Clickjacking_Defense_Cheat_Sheet.md Thanks you ## Impact An attacker could potentially include a payload like this, which could potentially affect the victim.

Nextcloud: Nextcloud Clickjacking Vulnerability