CWE-1022 UI Redress Attacks
What this means
SiteShadow flagged a risk of UI redress: attackers manipulate what a user sees (or where they click) to make them perform unintended actions. Clickjacking via iframes is the common case, but overlays and deceptive UI flows also qualify.
Why it matters
UI redress can cause unintended actions or data disclosure.
- Unauthorized actions by tricking the user (approve, delete, transfer, grant access).
- Credential/consent theft when users interact with real UI elements in a deceptive context.
- Often paired with high-value endpoints (billing, admin, OAuth consent screens).
Safer examples
1) Prevent framing for sensitive pages
Use CSP frame-ancestors and X-Frame-Options (see CWE-1021 / CLICK01).
2) Add step-up confirmations for dangerous actions
Use explicit confirmations / re-auth / MFA for actions like changing email, transferring funds, or granting admin access.
3) Use anti-CSRF and verify intent server-side
UI defenses help, but the server should also verify the request is legitimate (see CWE-352).
How SiteShadow detects it (high level)
- Detects pages with sensitive actions lacking anti-framing protections.
- Flags flows where high-impact actions rely only on UI "visibility" or client-side gating.
References
- CWE-1022: https://cwe.mitre.org/data/definitions/1022.html
---