User Account Deletion and more via Clickjacking in heroiclabs/nakama
Reported on
May 24th 2022
Description
As nakama console is not restricted from being loaded in an iframe, clickjacking attack is possible.
Proof of Concept
- Login to nakama console.
- Save the following as an .html file and open it in the browser to see that the page loads into an iframe.
<iframe src="http://<ip-address>:<port>"></iframe>
Impact
Deletion of user accounts in User Management section.
Deletion or Banning of users in the User Accounts
Deletion of Storage Objects and User Groups section and more.
While it impacts a number of features, adding a proper X-Frame-Options header in the response remediates all of the occurrences
Thanks for the report, we're looking into this and will respond in more depth as soon as possible.
Here is a video POC: https://www.youtube.com/watch?v=uyC-6HpwX34
I have removed the POC code added before as it required modification on a case by case basis to work. While the iframe code works to verify, here is a POC video.