cis-apache24-5.16

Ensure Browser Framing Is Restricted (Automated)

Profile Applicability

Level 2

Description

To prevent Clickjacking or UI Redressing attacks, it's important for the server to include an HTTP header which instructs browsers to restrict content from being framed. There are two headers that may be used. The Content-Security-Policy header, or the X-Frame-Options header. The Header directive allows server HTTP response headers to be added, replaced or merged. We will use the directive to add a server HTTP response header to tell browsers to restrict all of the web pages from being framed by other web sites.

Rationale

Using iframes and regular web frames to embed malicious content along with expected web content has been a favored attack vector for attacking web clients for a long time. This can happen when the attacker lures the victim to a malicious web site, which uses frames to include the expected content from the legitimate site. The attack can also be performed via XSS (either reflected, DOM or stored XSS) to add the malicious content to the legitimate web site.

To combat this attack vector, either an X-Frame-Options response header or a Content-Security-Policy response header may be used. The Content-Security-Policy header is the preferred solution. The X-Frame-Options header should have a value of either DENY, which prevents all framing, or SAMEORIGIN which prevents framing except via pages which share the same origin. The Content-Security-Policy header may also be to restrict framing with a frame-ancestors directive and a value of none or self

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

• Ensure a Header directive for Content-Security-Policy is present in the Apache configuration and has the condition always, an action of set or append and a directive of frame-ancestors none or self, as shown below:

  # grep -i Content-Security-Policy $APACHE_PREFIX/conf/httpd.conf
  

  Header always append Content-Security-Policy "frame-ancestors 'self'"
  

• If no Content-Security-Policy header, check if a header directive for X-Frame-Options is present in the Apache configuration and has the condition always, an action of set or append and a value of SAMEORIGIN or DENY, as shown below:

  # grep -i X-Frame-Options $APACHE_PREFIX/conf/httpd.conf
  

  Header always set X-Frame-Options SAMEORIGIN
  

If either header configuration is present and has as a compliant value, then the server is compliant.

Remediation

Perform the following to implement the recommended state:

Add or modify the Header directive for the Content-Security-Policy header in the Apache configuration to have the condition always, an action of append and a value of frame-ancestors self, as shown below.

Header always append Content-Security-Policy "frame-ancestors 'self'"

Default Value

Neither the Content-Security-Policy HTTP response header nor the X-Frame-Options header is generated by default.

References

1. https://httpd.apache.org/docs/2.4/mod/mod_headers.html#header
2. https://owasp.org/www-project-cheat-sheets/cheatsheets/Content_Security_Policy_Cheat_Sheet
3. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
4. https://en.wikipedia.org/wiki/Clickjacking

CIS Controls

v8:

• 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
  • Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and add-on applications.

v7:

• 8.5 Configure Devices Not To Auto-run Content

  • Configure devices to not auto-run content from removable media.

• 18.2 Ensure Explicit Error Checking is Performed for All In-house Developed Software

  • For in-house developed software, ensure that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats.