Skip to main content
A
Abdul L Koyappayil
Inspiring
September 17, 2014
Answered

How to prevent clickjacking issue in CF

  • September 17, 2014
  • 1 reply
  • 6315 views

I created a cfm template with below contents to test clickjacking issue.

<html>

<head>

<title>Clickjack test page</title>

</head>

<body>

<p>Website is vulnerable to clickjacking!</p>

<iframe src="https://abcd.rw.xyz.com/mer/nao/app_v4/" width="500" height="500"></iframe>

</body>

</html>

And when I executed this template I was able to click on the "iframe" part. Which indicates that there is a clickjacking issue.Right??.

Is there any way to prevent clickjacking issue via CF admin/application code.

This topic has been closed for replies.
Correct answer BKBK

Ok. Suppose , If I am adding the filter-mapping as given below then I cannot use iframe anywhere in the site https://abcd.rw.xyz.com/mer/nao/app_v4/. Thats what it means. Right???.

       <filter-mapping>

          <filter-name>CFClickJackFilterDeny</filter-name>

          <url-pattern>https://abcd.rw.xyz.com/mer/nao/app_v4/*</url-pattern>

      </filter-mapping>


In fact, on reviewing this, I think your above filter should be something like

<filter-mapping>

          <filter-name>CFClickJackFilterDeny</filter-name>

          <url-pattern>/mer/nao/app_v4/*</url-pattern>

</filter-mapping>

1 reply

B
Community Expert
BKBKCommunity Expert
Community Expert
September 20, 2014

Abdul L Koyappayil wrote:

I created a cfm template with below contents to test clickjacking issue.

<html>

<head>

<title>Clickjack test page</title>

</head>

<body>

<p>Website is vulnerable to clickjacking!</p>

<iframe src="https://abcd.rw.xyz.com/mer/nao/app_v4/" width="500" height="500"></iframe>

</body>

</html>

And when I executed this template I was able to click on the "iframe" part. Which indicates that there is a clickjacking issue.Right??.

Right, potentially. However, the question only makes sense if https://abcd.rw.xyz.com/mer/nao/app_v4/ is in your site. For example, if you replace that URL with http://www.google.com, you will find that no content will be displayed. You can interpret this to mean that Google has taken some precautions against clickjacking. I will therefore assume that the site you wish to protect is your own.

Clickjacking involves at least 3 parties: you (the Coldfusion site you wish to protect), the clickjacker (the foreign site that intends using the malicious frames) and the client (the initial target or victim, usually the browser). The attacker's aim is to manipulate the browser into an illegitimate interaction with your site. As the browser is where the vulnerability is, it is also where the defence has to be. That defence is in a form that all browsers understand: headers or Javascript.

Coldfusion has a new security setting especially to counteract clickjacking. It is configured in /WEB-INF/web.xml, and enables ColdFusion to send X-Frame-Options headers to the browser. As the documentation shows, you can enable it on the whole site, or on a per-mapping basis.  For example, the following filter will prevent the kind of clickjacking you mention, for every request to your site:

<filter-mapping>

<filter-name>CFClickJackFilterDeny</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

You could alternatively use Javascript on the pages you wish to protect. For examples, check out the Wikipedia on Framekillers.

A
Abdul L KoyappayilAuthor
Inspiring
September 22, 2014

In my config file I can see two filter-mapping settings as below.

  1.     <filter-mapping>

                  <filter-name>FusionReactor</filter-name>

                  <url-pattern>/*</url-pattern>

            </filter-mapping>

   2.

       -->

              <!-- ==================== Built In Filter Mappings ====================== -->

              <!-- The mapping for the SSI Filter -->

              <!--

              <filter-mapping>

                  <filter-name>ssi</filter-name>

                  <url-pattern>*.shtml</url-pattern>

              </filter-mapping>

       -->

Here the second one is commented.

I have two questions here.

1]Can I add the mapping ( that you mentioned in your last post) any where in this config file (web.xml)?

2]No need to mention the domain name in the URL pattern that is as below?.

     <filter-mapping>

          <filter-name>CFClickJackFilterDeny</filter-name>

          <url-pattern>https://abcd.rw.xyz.com/mer/nao/app_v4/*</url-pattern>

     </filter-mapping>

B
Community Expert
BKBKCommunity Expert
Community Expert
September 22, 2014

1) Make sure you are in the /WEB-INF/web.xml configuration file. It has a section for the clickjacking filter.

2) The pattern in my post (/*) stands for abcd.rw.xyz.com/*, where * is, as usual, the wildcard.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices