search

LSFLK / request-management

Generic issue management system for government
Apache License 2.0
0 stars 11 forks source link

Vulnerable to Click Jacking #268

Closed YujithIsura closed 4 years ago

YujithIsura commented 4 years ago

The website is vulnerable to click jacking attacks as demonstrated below.

Description / Vulnerability

This is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

Screen Shot 2020-05-21 at 2 37 29 PM

Recommendations

- Send the proper X-Frame-Options HTTP response headers that instruct the browser to not allow framing from other domains. -  Employ defensive code in the UI to ensure that the current frame is the most top-level window.

kosalag commented 4 years ago

Add annotation to ingress nginx.ingress.kubernetes.io/server-snippet: | add_header X-Frame-Options "DENY";

MrClemRkz commented 4 years ago

fixed for both frontend and backend admin.