CAPEC 描述
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
CAPEC 信息
前提条件
The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.缓解措施
Avoid clicking on untrusted links.Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.
相关弱点
| 弱点名称 | |
|---|---|
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. |
参考资料
REF-469
Cross Frame Scriptinghttps://www.owasp.org/index.php/Cross_Frame_Scripting
REF-470
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular SitesGustave Rydstedt, Elie Bursztein, Dan Boneh, and Collin Jackson.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
提交记录
| 名称 | 组织 | 日期 | 发布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction, Mitigations, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses |
