Description

Detects missing or improper frame-ancestors directive in the Content-Security-Policy (CSP) header. This vulnerability could allow attackers to embed the web page in malicious websites through iframes, potentially enabling clickjacking attacks where users unknowingly interact with the embedded content.

Detection Strategy

• Examines HTTP response headers for Content-Security-Policy (CSP) header

• Checks if the CSP header includes a frame-ancestors directive

• Reports a vulnerability if the frame-ancestors directive is missing or contains unsafe values like 'none' or '*'

• Triggers when examining HTTP responses that lack proper frame ancestry controls in their security headers