kingsleymensah Posted July 20, 2020 Share Posted July 20, 2020 Hi guys, i received an email from someone claiming to be a pentester and he says he found a vulnerability in my WHMCS Here is what he sent: "I am a security researcher and I found this vulnerability in your websitehttps://kingscel.com/ Bug type : UI Redress Impact : Phishing (account compromise) Description : Click jacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker. POC: <html> <head>UI REDRESSING</head> <body> <h1>WEBSITE IS VULNERABLE TO UI REDRESSING</h1> <iframe width=100% height=80% src="https://mydomain/whmcs/clientarea.php"></iframe> </body> <html> Impact: Any User can be lured in to click on whats look like a functionality of the website but is actually an attackers frame button containing some malicious javascript code or redirection code leading the user to a vulnerable site . And as the vulnerability persists even after the user is logged in which makes it even more sever. Suggested Fix: Add an iframe destroyer in the page headers. Please let me know if any more info needed ! Waiting for your reply and hopefully a bug bounty for responsibly reporting the issue ... Note: i am attaching a screenshot as proof of concept waiting for your response." Note: he just took a screenshot of my client area login page Should i be concerned? 0 Quote Link to comment Share on other sites More sharing options...
bear Posted July 20, 2020 Share Posted July 20, 2020 He's looking for reward. I've seen these sent to forums, plain HTML sites, Wordpress and more, though "iframe breaking" is a new angle. Ignore, and block the sender, he won't quit asking for money. 1 Quote Link to comment Share on other sites More sharing options...
kingsleymensah Posted July 20, 2020 Author Share Posted July 20, 2020 Just now, bear said: He's looking for reward. I've seen these sent to forums, plain HTML sites, Wordpress and more, though "iframe breaking" is a new angle. Ignore, and block the sender, he won't quit asking for money. ahhh..... thanks man. On it now! 0 Quote Link to comment Share on other sites More sharing options...
sol2010 Posted March 11, 2021 Share Posted March 11, 2021 While there is no need to panic, you could also look into preventing this - it is a phenomenon known as clickjacking. WHMCS has some info on it here: https://docs.whmcs.com/Further_Security_Steps#Defending_Against_Clickjacking You can read up on Content-Security-Policy: frame-ancestors 'self' on the useful page: https://developers.google.com/web/fundamentals/security/csp 0 Quote Link to comment Share on other sites More sharing options...
craigedmonds Posted June 7, 2021 Share Posted June 7, 2021 Errr........Why does WHMCS not provide this protection already, built in? 0 Quote Link to comment Share on other sites More sharing options...
bear Posted June 7, 2021 Share Posted June 7, 2021 Mainly because the best way is to change the Apache (Nginx, etc) conf file to do it properly, I'd guess. For cPanel, it can be done via the editor:https://documentation.cpanel.net/display/EA4/Advanced+Apache+Configuration Simple include file. 0 Quote Link to comment Share on other sites More sharing options...
Vander Host Posted September 22, 2022 Share Posted September 22, 2022 (edited) Just got approached by a similar security researcher. I've examined the three references in this post, namely: https://docs.whmcs.com/Further_Security_Steps#Defending_Against_Clickjackinghttps://owasp.org/www-community/attacks/Clickjackinghttps://documentation.cpanel.net/display/EA4/Advanced+Apache+Configuration Any more clues what exact directive needs to be added? As it happens we use WHM and Virtualmin and I'm pretty familiar with NGinx conf files, and Apache and so on, but all three references fail to actually tell you what to do. Edited September 22, 2022 by Vander Host 0 Quote Link to comment Share on other sites More sharing options...
SeanP Posted September 23, 2022 Share Posted September 23, 2022 I used the Apache directive from the following page I found in a Google search: https://geekflare.com/secure-apache-from-clickjacking-with-x-frame-options/ There is also a link to a "Header Checker" tool, that will verify if your site has the correct header implemented. 1 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.