CWE-1021: Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Detailed description

This weakness occurs when a web application fails to properly constrain or only partially constrains frame objects or UI layers that originate from another application or domain. As a result, an attacker can present or overlay elements from a different context atop the legitimate user interface, potentially deceiving users into performing actions they did not intend. The security impact depends on the functionality of the underlying application and the attacker’s ability to exploit masked or hidden controls within the embedded content.

Characteristics

Abstraction: base level weakness concerning how rendering layers are restricted. Structure: simple, focused on frames, iframes, and UI overlays. Likelihood of exploit: not quantified here. Introduction: primarily during implementation phase. Terminology includes clickjacking, UI redress attack, and tapjacking. Platforms: web based with potential cross-domain implications. Related weakness characteristics: interaction with display primitives and same-origin or cross-origin framing constraints.

• Clickjacking
• UI Redress Attack
• Tapjacking: "Tapjacking" is similar to clickjacking, except it is used for mobile applications in which the user "taps" the application instead of performing a mouse click.

Common consequences

Scopes include Access Control. Impacts include gaining privileges or assuming identity, bypassing protection mechanisms, reading application data, and modifying application data. An attacker may trick a user into performing actions that are masked or hidden from view. Impacts vary with the application's functionality, e.g., social media settings changes could be manipulated.

• Access Control

  Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data

  An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.

Mitigations

Implementation: Use X-Frame-Options to restrict how content can be framed and by which domains. Consider support for multiple domains. Implementation: Frame-breaker scripts on pages that should not be framed, with awareness of nested frames. Implementation: Employ Content Security Policy frame-ancestors or frame-src directives to restrict embedded content. Implementation: Restrict rendering within objects, embed, or applet elements.

• ImplementationThe use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multiple domains.
• ImplementationA developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does not intuitively account for multiple nested frames that can be presented to the user.
• ImplementationThis defense-in-depth technique can be used to prevent the improper usage of frames in web applications. It prioritizes the valid sources of data to be loaded into the application through the usage of declarative policies. Based on which implementation of Content Security Policy is in use, the developer should use the "frame-ancestors" directive or the "frame-src" directive to mitigate this weakness. Both directives allow for the placement of restrictions when it comes to allowing embedded content.
• ImplementationIn addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.

Detection methods

Automated Static Analysis (SAST) can identify some instances by examining source or binary code to model data flow from sources to sinks. This method is rated as high effectiveness for detecting potential patterns that connect input origins to external destinations.

• Automated Static AnalysisAutomated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)Effectiveness: High

Representative vulnerabilities

ObservedExamples include: CVE-2017-7440 where an email preview feature allows clickjacking via a crafted message; CVE-2017-5697 where a hardware or firmware web UI lacks sufficient clickjacking protection; CVE-2017-4015 involving clickjacking in a data loss prevention product via HTTP headers; CVE-2016-2496 tapjacking in a mobile OS permission dialog; CVE-2015-1241 tapjacking in a web browser related to navigation and touch events; CVE-2017-0492 where System UI allows a malicious app to create a full-screen overlay to gain privileges.

Sources and references

• MITRE CWE
• CWE Terms of Use

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.