CAPEC 描述
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
CAPEC 資訊
前置條件
The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.緩解措施
Avoid clicking on untrusted links.Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.
相關弱點
| 弱點名稱 | |
|---|---|
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. |
參考資料
REF-469
Cross Frame Scriptinghttps://www.owasp.org/index.php/Cross_Frame_Scripting
REF-470
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular SitesGustave Rydstedt, Elie Bursztein, Dan Boneh, and Collin Jackson.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction, Mitigations, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses |
