"Vunerability Found" Is it true?

Recently had a whitehack hacker letting us know the website is vunerable to clickjacking please see information below, Is this true and do I need to take action?

Bug type : UI Redressing
Impact : Phishing (account compromise)

Description :
Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.
Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.

POC:

"< html >
< body >
< h1 > Website is vulnerable to clickjacking< h1 >
< iframe width =100% height=80% src ="https://website.com/log-in ">< /iframe >
< /body >
< /html >"

Impact:
The site can also be opened in an iframe after the user has logged it making it hard for the user to avoid phishing.A user can be tricked into entering his credentials in what way are the placeholder for the original website details. And thus his credentials would be sent to the attacker. Furthermore the Payment page is also vulnerable to UI redressing Allowing for an attacker to gain access to the users payment credentials.

Remediation :
Add an iframe destroyer in the header of the page . Also if you would like for your website to open is specified Iframe origin headers then you can define the Origin headers for those websites or origins.

Thanks

No expert but I would have thought that was already taken care of in \includes\templates\template_default\common\html_header.php

Lines 19 & 20 (ZC v1.5.8a)

// Prevent clickjacking risks by setting X-Frame-Options:SAMEORIGIN
header('X-Frame-Options:SAMEORIGIN');

If you don't have those lines probably best to add them (unless your ZC version is really old then consider upgrading)

Strangely I do have these lines except mine was commented out on the template I am using. Strange, I have uncommented and will keep and eye on it.

Thanks!

DannyVarley:

Strangely I do have these lines except mine was commented out on the template I am using. Strange, I have uncommented and will keep and eye on it.

Thanks!

I had same issue on my template. If i uncomment it though my website refuses to load. My resolution to the issue was to set a htaccess rule like so....

<IfModule mod_headers.c>
    Header set Content-Security-Policy "frame-ancestors 'self' https://mydomainurl.uk;"
</IfModule>

If you find any errors on your site as a result of uncommenting that line like i did give the above a try in your htaccess in the root. Obviously make a backup first of the file and replace mydomainurl.uk with your domain.

It was only last week i used ssl labs to run a health check and found my site was a c grade!! :O By adding this and a few other additions to my htaccess my ssl score had less issues but it was still at c, turns out i had also at somepoint decided to follow prompts in cloudflare to use their ssl certificate and it caused some kind of conflict, I had to get my webhosts to reinstall the one they provide. Now i score a+ and i am getting many emails from seo sites saying "rank increase for such a keyword" ... substantial visibility increase seems to be the result.

Make sure to check all your pages though after uncommenting that line, there may be a template related reason behind it perhaps? i'm only a learner myself so it would be interesting to hear what others have to say on the matter of why that line could possibly being commented out :)

I be questioning the use of the template vendors going forward if this was a shipped change.

~Melanie

flappingfish:

It was only last week i used ssl labs to run a health check and found my site was a c grade!!

The free and pro plans at Cloudflare still use tls1.0, tls1.1, and weak ciphers. To get modern TLS and get rid of weak ciphers you need to be on the business plan, at $250 month.... nice upsell they got there.

mprough:

I be questioning the use of the template vendors going forward if this was a shipped change.

~Melanie

at this point, can we please encourage template vendors to make changes as opposed to boycotting them? zc needs more developers and templates, not less.

barco57:

The free and pro plans at Cloudflare still use tls1.0, tls1.1, and weak ciphers. To get modern TLS and get rid of weak ciphers you need to be on the business plan, at $250 month.... nice upsell they got there.

i do not use cloudflare, but that is not what i see on their developer docs page. perhaps i will start.

but any business that provides a valuable service for free should be applauded not criticized...

perhaps you can direct me to your free hosting plan?

carlwhat:

at this point, can we please encourage template vendors to make changes as opposed to boycotting them? zc needs more developers and templates, not less.

I feel that Carl, but creating garbage insecure templates for Zen Cart since I started with Zen in 2003. Let's face it, only one reason to remove that line and it's certainly not to benefit the template purchaser, nor their customers.

You can lead a horse to water, but after 20 years, you have to push it in.

@carlwhat
https://www.cloudflare.com/plans/

The site failed a PCI security scan
Note, when testing the ssl score account on qualys it got a score of "C" and all of the "failing" IP addresses were cloudflare IP addresses for weak ciphers and early versions of TLS.
It may be possible to set edge certificates in cloudflare dashboard on free plans to be a minimum of TLS 1.2 (TLS 1.0 is the version that Cloudflare sets by default for all customers using certificate-based encryption.) but you still have the problem of the cipher suites which requires the purchase the Advanced Certificate Manager add-on to be able to specify more secure cipher suites. I assume that most of the cost of the business plan is access to the WAF (Web Application Firewall)

Hi barco57
I am currently using a host which includes cloudflare features for free. Our company is now required to run quarterly PCI compliance scans. We have not had any issues with IP addresses failing scans.

If cloudflare is charging $200 a month it may be worth considering switching to a host which includes cloudflare as standard.

We have been using the host 20i for several years and have found them to be very reliable. I hope this helps.
Richard