Description

Detects scenarios where X-Frame-Options (XFO) header protection against clickjacking could potentially be bypassed. While XFO is present, the absence of CSP frame-ancestors directive as a secondary protection layer creates a security gap that could be exploited in certain browsers to enable clickjacking attacks.

Detection Strategy

• Checks if X-Frame-Options header is present in the HTTP response

• Verifies if Content-Security-Policy header is missing entirely

• If CSP exists, checks if frame-ancestors directive is absent

• Reports vulnerability if XFO is present but CSP frame-ancestors protection is missing