search

okcashpro / okcash.co.website

https://okcash.co - Okcash community website
MIT License
0 stars 0 forks source link

Vulnerability Report: Iframe Exploitation Attacker can perform any action within the iframe #3

Closed Liannajohn closed 1 year ago

Liannajohn commented 1 year ago

Hi team,

This time I founded this vulnerability in your website: https://okcash.co/

Severity: Medium

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn't return an X-Frame-Options header, which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a or

2.save it as .html eg s.html

3.and open that...

As far as I know, this data is enough to prove that your site is vulnerable to Clickjacking according to OWASP, it's more than enough.

https://www.owasp.org/index.php/Testing_for_Clickjacking_(OWASP-CS-004)

SOLUTION:

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

Check this out, and here is the solution for that.

Impact: Clickjacking is one of the security flaws which could be harmful in multiple scenarios such as, an attacker can impose a blind XSS payload, and it won't be visible; whenever any victim will click on anywhere of your web-page, the blind XSS is going to be executed and steal the victim cookies.

Moreover, attackers make the victim download any malicious file, allowing the attacker to remotely control the victim's PC and transfer any data or perform any unethical activity from the victim's PC without even his knowledge.

These are quite enough scenarios to understand the importance of this vulnerability.

I hope that you will fix this issue as soon as possible.

I look forward to hearing from you. Thank you

Liannajohn commented 1 year ago

Here is my BSC wallet address for reward: 0xda8DFdfCBE116557d9743Dc09B3bfae3A7f8B604

oktoshi commented 1 year ago

We already implemented them, credited and added your OK donation address for the community on the commit.

Dealt at: https://github.com/okcashpro/okcash.co.website/commit/4789b7014f955d5834db49f858d0a9952f422915

Thanks for your suggestions and support to keep the OK environment more secure for the community.

Liannajohn commented 1 year ago

Hi team,

Is there any update regarding the reward transfer and how much my reward is decided for my contribution?