URL is vulnerable to clickjacking
Z
Zomato
Submitted None
Actions:
Reported by
hacker_one_one
Vulnerability Details
Technical details and impact analysis
##The browser has verified the identity:
Successfully implemented in IE browser
##Reproduce steps:
URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking.
Run under the browser's code and you will see that the listed links are vulnerable to clickjacking attacks
```
<html>
<frameset cols="25%,25%,25%">
<frame src="https://www.zomato.com/robots.txt" />
<frame src="https://www.zomato.com/users/fan-feng-52680914" />
<frame src="https://www.zomato.com/cairns-qld" />
</frameset>
</html>
```
{F285366}
## Impact
Most of the zomato.com urls were tested and found that most basic urls support iframe display in IE.
E.g:
* https://www.zomato.com/users/fan-feng-52680914/edit
* https://www.zomato.com/invite
* https://www.zomato.com/cairns-qld
* https://www.zomato.com/cairns-qld/caffiend-cairns?zrp_bid=0&zrp_pid=14
* https://www.zomato.com/users/fan-feng-52680914/bookmarks
* https://www.zomato.com/users/fan-feng-52680914/managewallets
The hacker selected the **UI Redressing (Clickjacking)** weakness. This vulnerability type requires contextual information from the hacker. They provided the following answers:
**URL**
*.zomato.com
**Can a victim be tricked into unknowingly initiating a specific action?**
Yes
**What specific action can the user be tricked into?**
E.g: Hackers can lure users into the personal settings page, change data that is useful to hackers, delete accounts...
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
UI Redressing (Clickjacking)