HexBrain

Pushwoosh · Report #200419

Clickjacking

Validstatus
mediumseverity
7upvotes
2 Feb 2017disclosed

How it was found

Steps to reproduce:

create index.html file with following content:

<iframe sandbox="allow-scripts allow-forms" src="https://go.pushwoosh.com/register" width="1000" height="600"></iframe>

Open index.html in browser

Actual result: Pushwoosh viewed in iframe. Expected result: do not allow clickjacking Root cause:

var isInIFrame = (function () {
			try {
				return window.self !== window.top;
			} catch (e) {
				return true;
			}
		})();

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original