CWE-1021: Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How it's found
Improper Restriction of Rendered UI Layers or Frames is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Consequences
- Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data: An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.
Mitigations
- Implementation: The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multiple domains.
- Implementation: A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does not intuitively account for multiple nested frames that can be presented to the user.
- Implementation: This defense-in-depth technique can be used to prevent the improper usage of frames in web applications. It prioritizes the valid sources of data to be loaded into the application through the usage of declarative policies. Based on which implementation of Content Security Policy is in use, the developer should use the "frame-ancestors" directive or the "frame-src" directive to mitigate this weakness. Both directives allow for the placement of restrictions when it comes to allowing embedded content.
- Implementation: In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
How TurboPentest tests for this
TurboPentest's automated black-box pentest actively probes for clickjacking (Improper Restriction of Rendered UI Layers or Frames) using OWASP ZAP, which flags a missing anti-clickjacking header (X-Frame-Options or frame-ancestors) on the live target, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 1 dedicated rule for this weakness.
Tools: OWASP ZAP
Frequently asked questions
What is CWE-1021?
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How do you find Improper Restriction of Rendered UI Layers or Frames?
Improper Restriction of Rendered UI Layers or Frames is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1021?
Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data: An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.
Does TurboPentest test for Improper Restriction of Rendered UI Layers or Frames?
TurboPentest's automated black-box pentest actively probes for clickjacking (Improper Restriction of Rendered UI Layers or Frames) using OWASP ZAP, which flags a missing anti-clickjacking header (X-Frame-Options or frame-ancestors) on the live target, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 1 dedicated rule for this weakness.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest