UI REDRESSING in craigk5n/webcalendar

Valid

Reported on

Jun 25th 2022


Description

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Proof of Concept

1) Go to this URL: http://web.clickjacker.io/test?url=http:%2F%2Fwebcalendar.sourceforge.net%2Fdemo%2Flogin.php

2) Observe that the website is getting embeded in an Iframe.

3) Observe that the headers x-frame-options and content-security-policy frame ancestors are missing.

Impact

Users are tricked into performing all sorts of unintended actions are such as typing in the password, clicking on ‘Delete my account’ button, liking a post, deleting a post, commenting on a blog. In other words all the actions that a normal user can do on a legitimate website can be done using clickjacking.

We are processing your report and will contact the craigk5n/webcalendar team within 24 hours. a month ago
We have contacted a member of the craigk5n/webcalendar team and are waiting to hear back a month ago
We have sent a follow up to the craigk5n/webcalendar team. We will try again in 7 days. a month ago
craigk5n/webcalendar maintainer has acknowledged this report a month ago
Craig Knudsen validated this vulnerability a month ago
tharunavula has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Craig Knudsen confirmed that a fix has been merged on bb7c65 a month ago
Craig Knudsen has been awarded the fix bounty
to join this conversation