Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clickjacking vulnerability at https://alpha.pstake.finance #23

Open
4 tasks done
Shashank-In opened this issue Jun 22, 2021 · 4 comments
Open
4 tasks done

Clickjacking vulnerability at https://alpha.pstake.finance #23

Shashank-In opened this issue Jun 22, 2021 · 4 comments

Comments

@Shashank-In
Copy link

Shashank-In commented Jun 22, 2021 •
edited
Loading

Describe the bug
Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.https://cwe.mitre.org/data/definitions/451.html

To Reproduce

  1. Save the below code in an HTML file and we will notice that the web application can be iframed.
<!DOCTYPE HTML>
<html lang="en-US">
<head>
<meta charset="UTF-8">
<title>i Frame</title>
</head>
<body>
<h3>This is clickjacking vulnerable</h3>
<iframe src="https://alpha.pstake.finance" frameborder="200 px" height="500px">
</body>
</html>

Expected behaviour
The web application should not allow the application to be loaded inside an iframe

Screenshots

Desktop (please complete the following information):

  • Browser chrome, safari, firefox
  • Version [latest]

Smartphone (please complete the following information):
All devices

Additional context
Suggested Fix:

  1. Use the X-Frame-Options: DENY HTTP response header on pages with sensitive information, to disallow framing of the page on external resources.
  2. In the case where DENY is not an option, use X-Frame-Options: SAMEORIGIN.
  3. Implement Content Security Policy with the directive frame-ancestors set to 'none', 'self', or the additional domains that are allowed to iframe the application.

Ethereum address
0xdc3442769DB7D34e6468Ded0b9B2a1baa4630C99

Criticality Assessment
Please pick one:

  • Low: An issue that might cause user dissatisfaction or minimal failure of the application

Checklist

  • The reported issue is in the scope of the pStake BugBounty program.
  • This issue has not been reported before.
  • The ethereum address filled in is valid.
@Shashank-In
Copy link
Author

screenshot

Screenshot 2021-06-22 at 8 26 12 PM

@vision2point0
Copy link

pSTAKE is a react app which is a javascript drive SPA. X-Frame-Options is a HTTP header and setting it depends on the application you use as HTTP server, not on the files being served. Not sure if this is relevant in our scenario unless you can provide a very specific example of an attack vector.

@Shashank-In
Copy link
Author

Shashank-In commented Jul 1, 2021 •
edited
Loading

@aditim121
I am not sure about the relevance of your statement. Crafting an attack vector for a PoC will be very time taking so I created a vulnerability POC rather than an exploit. I do agree the impact is low but the attack vector is self-explanatory.
https://auth0.com/blog/preventing-clickjacking-attacks/
And as far as I know, be it react app or any. Clickjacking can be fixed. Or at least a frame buster can be implemented.
Ref: https://en.wikipedia.org/wiki/Framekiller

@kombos
Copy link

kombos commented Jul 22, 2021

since this is a blockchain based app, one can only create transactions which are part of the smart contract, and only using their keys stored in metamask. even in the scenario of such a clickjacking attack vector, ultimately the txn cannot be spoofed to a different smart contract since metamask provides complete data before sending the txn.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Shashank-In @kombos @vision2point0