X-Frame-Options missing, clickjacking surface present
All HTML responses
description
Pages do not set `X-Frame-Options` or a CSP `frame-ancestors` directive. Authenticated pages (including the billing settings page) can be embedded in a third-party site's iframe, enabling clickjacking attacks that trick users into performing actions on acme.dev while interacting with the attacker's overlay.
evidence
Request
GET /settings/billing HTTP/1.1 Host: acme.dev Cookie: session=...
Response
HTTP/1.1 200 OK Content-Type: text/html (no X-Frame-Options or frame-ancestors)
reproduction steps
- Issue an authenticated request to /settings/billing.
- Observe the response has neither X-Frame-Options nor a frame-ancestors CSP directive.
- Host a third-party page that embeds `<iframe src="https://acme.dev/settings/billing">` and observe the iframe load.
remediation
`Content-Security-Policy: frame-ancestors 'none'` (or `'self'` if you legitimately frame your own pages). `X-Frame-Options: DENY` as a legacy fallback for older browsers, not the primary control.
rotate the credentials you provided.
we ran the scan with the credentials you supplied. treat them as compromised and rotate now.
couldn't reproduce this finding?
if it does not reproduce from the evidence above, you get back what this finding cost you: its credits for a credit unlock, or a cash refund for a finding bought through our earlier per-finding checkout. see how claims work, or email team@recon.sh with finding ID f9 and scan ID sample.