Closed Bug 1130875 Opened 11 years ago Closed 11 years ago

ClickJacking at https://marketplace.firefox.com

Categories

(Marketplace Graveyard :: Security, defect)

Product:
Marketplace Graveyard
Component:
Security
Version:
Avenir
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 872531

People

(Reporter: p4r3sh.p4rm4r, Unassigned)

References

Details

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 Build ID: 20150122214805 Steps to reproduce: Save this Source code with .html extension after saving run the html file. now open the file. <html></html> <div style="z-index:2; position:absolute;top:0; left:0;width: 80%; height:80%"> <iframe src=" https://marketplace.firefox.com" id="frame1" style="opacity:0.4;filter:alpha(opacity=40); " width="100%" height="100%" onmouseover="this.style.opacity=.5;this.filters.alpha.opacity=50" onmouseout="this.style.opacity=0;this.filters.alpha.opacity=0"/></iframe></div> <div align="right" style="position:absolute; top:0; left:0; z-index:1; width: 80%;height:80%; background-color: yellow;text-align:left;"> <strong>Clickjaking poc by paresh </p> </strong><br/></div> Actual results: Clickjacking: It might be possible for a web page controlled by an attacker to load the content of this response within an iframe on the attacker's page. This may enable a "clickjacking" attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. By inducing victim users to perform actions such as mouse clicks and keystrokes, the attacker can cause them to unwittingly carry out actions within the application that is being targeted. This technique allows the attacker to circumvent defenses against cross-site request forgery, and may result in unauthorized actions. fix: You should review the application functions that are accessible from within the response, and determine whether they can be used by application users to perform any sensitive actions within the application. If so, then a framing attack targeting this response may result in unauthorized actions. To effectively prevent framing attacks, the application should return a response header with the name X-Frame-Options and the value DENY to prevent framing altogether, or the value SAMEORIGIN to allow framing only by pages on the same origin as the response itself. For mitigation, you may want to add the HTTP header XFRAMEOPTIONS and set it to DENY
hey Guys, any update??? its almost month now// Thank You
Component: Untriaged → Security
OS: Windows 8.1 → All
Product: Firefox → Marketplace
Hardware: x86_64 → All
Version: 35 Branch → Avenir
Status: UNCONFIRMED → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.