Improper Restriction of Rendered UI Layers or Frames in filegator/filegator


Reported on

Aug 6th 2021

Clickjacking is a portmanteau of two words ‘click’ and ‘hijacking’. It refers to hijacking user’s click for malicious intent. In it, an attacker embeds the vulnerable site in an transparent iframe in attacker’s own website and overlays it with objects such as button using CSS skills. This tricks users to perform unintended actions on vulnerable website, thinking they are doing those on attacker’s website. Clickjacking, also known as a "UI redress attack".


Please visit this website


Users are tricked into performing all sorts of unintended actions are such as typing in the password, clicking on ‘Delete my account’ button, liking a post, deleting a post, commenting on a blog. In other words all the actions that a normal user can do on a legitimate website can be done using clickjacking.

We have contacted a member of the filegator team and are waiting to hear back 2 years ago
2 years ago


hi @admin, any updates on this so far

2 years ago


Hey, not yet. The maintainers should have already been notified. Perhaps you can remind them on GitHub and refer to this report as they should already have access.

We are working on an automatic follow-up system, so that if maintainers miss the first email, they will be reminded again. I'm sure this will be valuable for situations like these.

Milos Stojanovic validated this vulnerability 2 years ago
sudheendra17 has been awarded the disclosure bounty
The fix bounty is now up for grabs
Milos Stojanovic marked this as fixed with commit 63645f 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation