[wp-trac] [WordPress Trac] #37859: Click Jacking On Wordpress Websites Admin Panel

[WordPress Trac]

#37859: Click Jacking On Wordpress Websites Admin Panel
--------------------------+-----------------------------
 Reporter:  sonugpc       |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  General       |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 Dear Team,

 I want to report you a ClickJacking Vulnerability which allows the attack
 to trick victim to change his account information.

 Description :

 Clickjacking, also known as a "UI redress attack", is when an attacker
 uses multiple transparent or opaque layers to trick a user into clicking
 on a button or link on another page when they were intending to click on
 the the top level page. Thus, the attacker is "hijacking" clicks meant for
 their page and routing them to another page, most likely owned by another
 application, domain, or both.

 Using a similar technique, keystrokes can also be hijacked. With a
 carefully crafted combination of stylesheets, iframes, and text boxes, a
 user can be led to believe they are typing in the password to their email
 or bank account, but are instead typing into an invisible frame controlled
 by the attacker.

 Affected Resources:

 Any Wordpress Website

 Impacts:

 1. Attacker can simply trick the victim to change his account details.
 2. please note there are other infected point too but this one is
 critical.

 POC:

 Kindly find the attached file as a proof of concept.

 How to fix :

 Sending the proper X-Frame-Options HTTP response headers that instruct the
 browser to not allow framing from other domains. i.e.
 X-FRAME-Options must be set to either deny or sameorigin

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37859>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform