CWE-1021: Improper Restriction of Rendered UI Layers or Frames

The weakness occurs when content can be rendered within, over, or alongside a user interface from another application or domain without adequate restrictions. An attacker can use this behavior to disguise the location or purpose of a control and induce a user to interact with an unintended underlying application. The issue is commonly associated with clickjacking and UI redress attacks; the comparable mobile scenario is often called tapjacking, where the user taps a manipulated interface.

This is an implementation-phase weakness affecting web-based applications and is not specific to a programming language or technology. Its defining behavior is the failure to enforce which external applications or domains may frame or otherwise render the application, including through frames, overlays, or related embedding elements. The record also identifies clickjacking, UI redress attack, and tapjacking as associated terms, with tapjacking referring to touch-based interaction in mobile applications.

The primary impact is on access control. By causing a user to activate concealed or misleading controls, an attacker may help gain privileges or assume an identity, bypass a protection mechanism, read application data, or modify application data. The specific result depends on the functionality exposed by the underlying application, such as changing privacy settings in a social media application.

Apply layered restrictions during implementation:

• Use X-Frame-Options to specify which domains may frame the application, while accounting for limitations and implementation gaps, including requirements to allow multiple domains.
• For legacy browsers that do not support X-Frame-Options, use a frame-breaker script on pages that should not be framed. This is not sufficient by itself because frame-breaking scripts can be bypassed and may not correctly handle multiple nested frames.
• As defense in depth, use Content Security Policy restrictions. Depending on the policy implementation, apply the frame-ancestors or frame-src directive to control permitted embedded content.
• Restrict whether the application may be rendered through object, embed, or applet elements, in addition to controlling frames and iframes.

Automated static analysis, also known as Static Application Security Testing, can identify some instances without executing the application. It can model data flow and control flow in source or compiled code and search for vulnerable patterns connecting input sources to sinks that interact with external components or lower layers. The method is rated highly effective in the record, but the record describes it as capable of finding some instances rather than all instances.

The official record provides these representative examples, not an exhaustive list:

• CVE-2017-7440: A desktop application's email preview feature allowed clickjacking through a crafted email message.
• CVE-2017-5697: A hardware or firmware product had insufficient clickjacking protection in its web user interface.
• CVE-2017-4015: A data-loss prevention product was vulnerable to clickjacking through an HTTP response header.
• CVE-2016-2496: Tapjacking in a mobile operating system permission dialog enabled access to private storage through a partially overlapping window.
• CVE-2015-1241: A web browser was affected by tapjacking involving page navigation and touch or gesture events.
• CVE-2017-0492: A mobile operating system's system UI allowed a malicious application to create a full-screen UI overlay and gain privileges.