iframe Injection

Detects user-controlled content injected into iframe src attributes, enabling page embedding of malicious content.

zakirkun ea09df5 2 files · 2.0 KB Updated

File contents

iframe Injection

Overview

Injecting user-controlled URLs into <iframe src="..."> allows attackers to embed arbitrary external content in the application's page, enabling:

  • Content spoofing (fake login forms within trusted domain)
  • Clickjacking of inner content
  • Cross-site cookie access in older browsers

Remediation

  • Validate and whitelist iframe src URLs against allowed domains
  • Use sandbox attribute on iframes
  • Set CSP frame-src to restrict allowed iframe sources

zakirkun/ice-tea/tree/main/skills/web/iframe-injection commit ea09df5fba

Frequently asked questions

npx skillmds@latest add zakirkun/iframe-injection