cis-apache-5-14

name	cis-apache-5.14
description	Ensure Browser Framing Is Restricted
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","features","options"]
cis_id	5.14
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Browser Framing Is Restricted

Description

The Header directive allows server HTTP response headers to be added, replaced, or merged. Use the directive to add a server HTTP response header to tell browsers to restrict all the web pages from being framed by other web sites.

Rationale

Using iframes and regular web frames to embed malicious content along with expected web content has been a favored attack vector for attacking web clients for a long time. This can happen when the attacker lures the victim to a malicious web site, which uses frames to include the expected content from the legitimate site. The attack can also be performed via XSS (either reflected, DOM or stored XSS) to add the malicious content to the legitimate web site. To combat this vector, an HTTP Response header, X-Frame-Options, has been introduced that allows a server to specify whether a web page may be loaded in any frame (DENY) or only those frames that share the page's origin (SAMEORIGIN).

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

Ensure a Header directive for X-Frame-Options is present in the Apache configuration and has the condition always, an action of append, and a value of SAMEORIGIN, as shown below:

# grep -i X-Frame-Options $APACHE_PREFIX/conf/httpd.conf
Header always append X-Frame-Options SAMEORIGIN

Remediation

Perform the following to implement the recommended state:

Add or modify the Header directive for the X-Frame-Options header in the Apache configuration to have the condition always, an action of append, and a value of SAMEORIGIN, as shown below.

Header always append X-Frame-Options SAMEORIGIN

Default Value

The X-Frame-Options HTTP response header is not generated by default

References

1. http://httpd.apache.org/docs/2.2/mod/mod_headers.html#header
2. https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
3. http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

CIS Controls

Version 6

18 Application Software Security Application Software Security