cis-apache24-5-16

name	cis-apache24-5.16
description	Ensure Browser Framing Is Restricted
category	cis-apache
version	2.3.0
author	cyberstrike-official
tags	["cis","apache","linux","features","content","options"]
cis_id	5.16
cis_benchmark	CIS Apache HTTP Server 2.4 Benchmark v2.3.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Browser Framing Is Restricted (Automated)

Profile Applicability

Level 2

Description

To prevent Clickjacking or UI Redressing attacks, it's important for the server to include an HTTP header which instructs browsers to restrict content from being framed. There are two headers that may be used. The Content-Security-Policy header, or the X-Frame-Options header. The Header directive allows server HTTP response headers to be added, replaced or merged. We will use the directive to add a server HTTP response header to tell browsers to restrict all of the web pages from being framed by other web sites.

Rationale

Using iframes and regular web frames to embed malicious content along with expected web content has been a favored attack vector for attacking web clients for a long time. This can happen when the attacker lures the victim to a malicious web site, which uses frames to include the expected content from the legitimate site. The attack can also be performed via XSS (either reflected, DOM or stored XSS) to add the malicious content to the legitimate web site.

To combat this attack vector, either an X-Frame-Options response header or a Content-Security-Policy response header may be used. The Content-Security-Policy header is the preferred solution. The X-Frame-Options header should have a value of either DENY, which prevents all framing, or SAMEORIGIN which prevents framing except via pages which share the same origin. The Content-Security-Policy header may also be to restrict framing with a frame-ancestors directive and a value of none or self

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

• Ensure a Header directive for Content-Security-Policy is present in the Apache configuration and has the condition always, an action of set or append and a directive of frame-ancestors none or self, as shown below:

  # grep -i Content-Security-Policy $APACHE_PREFIX/conf/httpd.conf
  

  Header always append Content-Security-Policy "frame-ancestors 'self'"
  

• If no Content-Security-Policy header, check if a header directive for X-Frame-Options is present in the Apache configuration and has the condition always, an action of set or append and a value of SAMEORIGIN or DENY, as shown below:

  # grep -i X-Frame-Options $APACHE_PREFIX/conf/httpd.conf
  

  Header always set X-Frame-Options SAMEORIGIN
  

If either header configuration is present and has as a compliant value, then the server is compliant.

Remediation

Perform the following to implement the recommended state:

Add or modify the Header directive for the Content-Security-Policy header in the Apache configuration to have the condition always, an action of append and a value of frame-ancestors self, as shown below.