HAX CMS' application pages are vulnerable to clickjacking

Vulnerability

HAX CMS, a platform for managing microsites with NodeJS or PHP backends, fails to set the X-Frame-Options header or Content-Security-Policy: frame-ancestors directive on any of its pages. This affects both the CMS interface and sites generated by the CMS in haxcms-nodejs versions 11.0.12 and below, and haxcms-php versions 11.0.7 and below [1][4]. The absence of these headers allows any website to embed HAX CMS pages within an iframe.

Exploitation

An unauthenticated attacker can craft a malicious webpage that loads the HAX CMS login page or other sensitive functionality (such as content editing or administration panels) in an invisible iframe. By overlaying deceptive UI elements, the attacker can trick a victim into performing unintended actions, such as clicking buttons or entering credentials, effectively conducting a clickjacking (UI redressing) attack [1][4].

Impact

Successful exploitation can lead to social engineering attacks where users unknowingly execute actions on the HAX CMS application, potentially compromising the integrity of the CMS or exposing sensitive data. The attack requires no authentication and can be launched from any external site [1][4].

Mitigation

The issue is fixed in haxcms-nodejs version 11.0.13 and haxcms-php version 11.0.8. The fix adds the frame-ancestors: 'self' directive to the Content-Security-Policy header, preventing the site from being loaded by other origins in an iframe [3]. Users are advised to update to the patched versions immediately.