Clickjacking

Clickjacking

Category: Security Misconfiguration

Severity: Medium

Description

Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.

Impact

Attackers may abuse clickjacking vulnerabilities for many different purposes:

• To gain followers on social media and then, possibly, sell the social media account/page for mass marketing.

• To gain email or RSS subscribers for the same purpose as social media followers.

• To use the fact that the user is logged into their e-commerce account and have them buy products on behalf of the attacker.

• To have the user unknowingly transfer funds to the attacker.

• To have the user download malware (e.g. a trojan).

Remediation

To effectively prevent framing attacks, the application should return a response header with the name X-Frame-Options and the value DENY to prevent framing altogether, or the value SAMEORIGIN to allow framing only by pages on the same origin as the response itself. Note that the SAMEORIGIN header can be partially bypassed if the application itself can be made to frame untrusted websites.