2

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security scripts like frame busters, killers & etc.

For example, here are three pages:

Victims Page

<html>
<head>
<script type="text/javascript">
if(top != self) top.location.replace(location);
</script>
</head>
<body bgcolor="red">
<img src="kitten.jpg" width="100%" height="100%">
</body>
</html>

This page contains a very poor frame buster, but good enough for this demonstration. In case the page is not the top frame in his window it redirects the window to the page location.

Page A 

<html>
<body>
<center><iframe src="noIFrame.htm" border=1>    </center>
</body>
</html>

This page contains an example, what happens when the attacker just add the page using iframe, without enabling the security attribute on. The result of opening this page is a quick glance at the click jackers page and then the browser redirection to the page location.

Page B

<html>
<body>
<center><iframe src="noIFrame.htm" security="restricted" border=1></center>
</body>
</html>

Finally, this page demonstrates implementing the security attribute. The iFrame is loaded, and since the attribute is set to restricted the frame busting script is not redirecting the browser to the victims page location. Note this attack is viable only in IE8 and above.

Now assuming a malicious user can upload files to the victims web server*, (disabling by my understanding the possible use of X-Frame-Options) how can the victim protect his website from click jacking attacks against his IE users?

*This is an hypothetical question, of course if attacker has access to the web server domain he would attack differently.

Improve this question

1 Answer 1

Reset to default
3

The only way to prevent clickjacking on a version of IE too old to support X-Frame-Options is to make the page dependent on JavaScript, so that it breaks when run with security="restricted". For example:

<style type="text/css">
   body.notframed #warning { display: none; }
   body.framed #content { display: none; }
</style>
<body class="framed">
   <script type="text/javascript">
       if (top==self)
           document.body.className= 'notframed';
   </script>
   <div id="content">
       ...
   </div>
   <div id="warning">
       This site cannot be used in a frame or with JavaScript disabled.
   </div>
</body>

Obviously this has strongly negative accessibility implications. If the site in question already doesn't work without JS it might be acceptable, but it isn't usually worth it.

(It also demonstrates the tactic of making your page unusable instead of trying to redirect the top page as in the 'very poor' framebuster. Indeed, the redirect option cannot be made secure.)

I'm not sure what your last comment is referring to - X-Frame-Options doesn't prevent file uploads, but it works fine to protect against framing from any site (third- or first-party), the only problem with it is the lack of support in old versions of IE.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .