Severity: Low
Netsparker identified an external insecure or misconfigured iframe.
IFrame sandboxing enables a set of additional restrictions for the content within a frame in order to restrict its potentially malicious code from causing harm to the web page that embeds it.
The Same Origin Policy (SOP) will prevent JavaScript code from one origin from accessing properties and functions - as well as HTTP responses - of different origins. The access is only allowed if the protocol, port and also the domain match exactly.
Here is an example, the URLs below all belong to the same origin as http://site.com :
http://site.com
http://site.com/
http://site.com/my/page.html
Whereas the URLs mentioned below aren't from the same origin as http://site.com :
http://www.site.com (a sub domain)
http://site.org (different top level domain)
https://site.com (different protocol)
http://site.com:8080 (different port)
When the sandbox
attribute is set, the iframe content is treated as being from a unique origin, even if its hostname, port and protocol match exactly. Additionally, sandboxed content is re-hosted in the browser with the following restrictions:
When the sandbox
attribute is not set or not configured correctly, your application might be at risk.
A compromised website that is loaded in such an insecure iframe might affect the parent web application. These are just a few examples of how such an insecure frame might affect its parent:
Sandbox
containing a value of :
allow-same-origin
will not treat it as a unique origin.allow-top-navigation
will allow code in the iframe to navigate the parent somewhere else, e.g. by changing parent.location.allow-forms
will allow form submissions from inside the iframe.allow-popups
will allow popups.allow-scripts
will allow malicious script execution however it won't allow to create popups.<iframe sandbox src="framed-page-url"></iframe>
seamless
attribute and allow-top-navigation
, allow-popups
and allow-scripts
in sandbox attribute.