Bug 1990363 (CVE-2023-4958)

Summary:	CVE-2023-4958 stackrox: Missing HTTP security headers allows for clickjacking in web UI
Product:	[Other] Security Response	Reporter:	lnacshon
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jburrell, sfowler
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1989640

Description lnacshon 2021-08-05 09:23:45 UTC

In RHACS 3.63.0 Ui it was found to be is vulnerable to Clickjacking. This is caused due to missing HTTP headers (X-Frame-Options or Content-Security-Policy) this is helping an attacker to load an iframe and trick the user to click and transferred it into their malformed website.

Comment 6 Sam Fowler 2023-09-15 05:38:14 UTC

Upstream fix:

https://github.com/stackrox/stackrox/pull/6839

Comment 7 errata-xmlrpc 2023-09-18 16:40:21 UTC

This issue has been addressed in the following products:

  RHACS-4.2-RHEL-8

Via RHSA-2023:5206 https://access.redhat.com/errata/RHSA-2023:5206