New Zenner
- Join Date:
- Dec 2012
- Posts:
- 1
- Plugin Contributions:
- 0
X-Frame Options Missing
The X-Frame Options is missing on the Zen Cart v1.5.1
Testing Environment:
Operating System: Windows 7 (32-bit)
Browser: Mozilla Firefox v17.0
Firefox Addon: Clickjacking Defense (https://addons.mozilla.org/en-us/firefox/addon/clickjacking-defense-declar/)
Impact: Highly Critical
Description of the Issue: As there is no X-Frame Options, the latest stable release of Zen Cart v1.5.1 is vulnerable to UI Redressing(ClickJacking) attack. All the modules of Zen Cart can be opened inside a malicious frame and from the attacker point of view various malicious activity can be carried over a victim end.
Mitigation: An X-Frame Options must be set in the headers as DENY or SAME ORIGIN.
References: https://www.owasp.org/index.php/Clickjacking
Regards,
Himanshu(@mehimansu)