723745 - Clickjacking in Bugzilla 3.4 Branch.

Status: RESOLVED DUPLICATE of bug 475894

(Bugzilla :: Bugzilla-General, defect)

Description

[Mario Gomes]

Attachment: Vulnerability Exploit Demonstration.

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.1 Safari/535.19

Steps to reproduce:

Hi,

Bugzilla 3.4 Branch allows clickjacking attacks, thus allowing an attacker to make such comments is little integration of the User. The vulnerability is due to not using a "framekiller" or the header "X-FRAME-OPTIONS".


Reproduce:
1. Log in https://landfill.bugzilla.org/bugzilla-3.4-branch.
2. Go to data:text/html,<iframe height=1000 width=1000 src="https://landfill.bugzilla.org/bugzilla-3.4-
branch/show_bug.cgi?id=10903">
3. See the bug in a IFRAME.

Exploiting reproduce(Works only in Firefox):
1. Log in https://landfill.bugzilla.org/bugzilla-3.4-branch.
2. Open the attachment.
3. Drag the text "Drag Me!" in whitebox and click in "Go!".
4. Back to https://landfill.bugzilla.org/bugzilla-3.4-branch
5. See your comment.

Cheers,
Mario.

Comment 1

[Frédéric Buclin]

We know 3.4 is vulnerable to clickjacking, see bug 475894. This story about attachments is known for a long time, as we fixed that in 4.0 and newer as it's considered a security enhancement and not a security bug. No need to report such bugs for 3.x.