CVE-2022-3167 (published 2022-09-08T19:15Z)

Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1021
cwe_name: Improper Restriction of Rendered UI Layers or Frames
description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
extended_description: A web application is expected to place restrictions on whether it is allowed to be rendered within frames, iframes, objects, embed or applet elements. Without the restrictions, users can be tricked into interacting with the application when they were not intending to.
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-09-08 07:57:01-04:00
msg: Add Clickjacking Defense
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -107,6 +107,10 @@ Professional support for Rdiffweb is available by contacting [IKUS Soft](https:/
 
 # Changelog
 
+## 2.4.1 (2022-09-08)
+
+* Add Clickjacking Defense
+
 ## 2.4.0 (2022-06-21)
 
 This new release brings a lot of improvement since the last version, multiple bug fixes

programming_language: Markdown
filename: test_csrf.py
change_type: ModificationType.MODIFY
diff: @@ -71,3 +71,11 @@ class CsrfTest(rdiffweb.test.WebCase):
         self.getPage('/', method='POST')
         # Then the request is accepted with 200 OK
         self.assertStatus(200)
+
+    def test_clickjacking_defense(self):
+        # Given a POST request made to rdiffweb
+        # When the request is made without an origin
+        self.getPage('/')
+        # Then the request is accepted with 200 OK
+        self.assertStatus(200)
+        self.assertHeaderItemValue('X-Frame-Options', 'DENY')

programming_language: Python
filename: security.py
change_type: ModificationType.MODIFY
diff: @@ -36,10 +36,13 @@ class CsrfAuth(HandlerTool):
     """
     This tool provide CSRF mitigation.
 
-    First, by defining `SameSite=Lax` on the cookie
-    Second by validating the `Origin` and `Referer`.
+    * Define X-Frame-Options = DENY
+    * Define Cookies SameSite=Lax
+    * Validate `Origin` and `Referer` on POST, PUT, PATCH, DELETE
 
-    Ref.: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
+    Ref.:
+    https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
+    https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
     """
 
     def __init__(self):
@@ -48,14 +51,17 @@ class CsrfAuth(HandlerTool):
         self._priority = 71
 
     def _setup(self):
-        cherrypy.request.hooks.attach('before_finalize', self._set_same_site)
+        cherrypy.request.hooks.attach('before_finalize', self._set_headers)
         return super()._setup()
 
-    def _set_same_site(self):
+    def _set_headers(self):
+        response = cherrypy.serving.response
+        # Define X-Frame-Options to avoid Clickjacking
+        response.headers['X-Frame-Options'] = 'DENY'
         # Awaiting bug fix in cherrypy
         # https://github.com/cherrypy/cherrypy/issues/1767
         # Force SameSite to Lax
-        cookie = cherrypy.serving.response.cookie.get('session_id', None)
+        cookie = response.cookie.get('session_id', None)
         if cookie:
             cookie['samesite'] = 'Lax'
 

programming_language: Python