Improper Restriction of Rendered UI Layers or Frames in opensourcepos/opensourcepos

Valid

Reported on

Aug 26th 2021


✍️ Description

It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY.

🕵️‍♂️ Proof of Concept

Image: https://i.ibb.co/cbtVcb1/clickjack.png

💥 Impact

According to PortSwigger references, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. By inducing victim users to perform actions such as mouse clicks and keystrokes, the attacker can cause them to unwittingly carry out actions within the application that is being targeted. This technique allows the attacker to circumvent defenses against cross-site request forgery and may result in unauthorized actions.

Occurences

Ziding Zhang
3 months ago

Admin


Hey Melbin, I've just emailed the repo maintainer about this report.

We have contacted a member of the opensourcepos team and are waiting to hear back 3 months ago
We have contacted a member of the opensourcepos team and are waiting to hear back 3 months ago
jekkos validated this vulnerability 3 months ago
Melbin Mathew Antony has been awarded the disclosure bounty
The fix bounty is now up for grabs
jekkos confirmed that a fix has been merged on 136448 3 months ago
jekkos has been awarded the fix bounty