git.samba.org / ddiss / samba.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: d2e9007)
swat: Use X-Frame-Options header to avoid clickjacking
authorKai Blin <kai@samba.org>
Fri, 18 Jan 2013 22:11:07 +0000 (23:11 +0100)
committerKarolin Seeger <kseeger@samba.org>
Tue, 29 Jan 2013 10:16:41 +0000 (11:16 +0100)
Jann Horn reported a potential clickjacking vulnerability in SWAT where
the SWAT page could be embedded into an attacker's page using a frame or
iframe and then used to trick the user to change Samba settings.

Avoid this by telling the browser to refuse the frame embedding via the
X-Frame-Options: DENY header.

Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9576 - CVE-2013-0213: Clickjacking issue in SWAT.

source3/web/swat.c patch | blob | history

diff --git a/source3/web/swat.c b/source3/web/swat.c
index 90e4af9958faf4cdd0c19593c4ae91f58d5220bf..1eb191d5da487dc869d6e1efa729d888149abfcc 100644 (file)
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -269,7 +269,8 @@ static void print_header(void)
        if (!cgi_waspost()) {
                printf("Expires: 0\r\n");
        }
-       printf("Content-type: text/html\r\n\r\n");
+       printf("Content-type: text/html\r\n");
+       printf("X-Frame-Options: DENY\r\n\r\n");
 
        if (!include_html("include/header.html")) {
                printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n");
ddiss' public Samba repository