Description of the problem: The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack. Clickjacking, also known as a 'UI redress attack', is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is 'hijacking' clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.

Release version: 2.4.4

Operator snapshot version: Unknown

OCP version: 4.9

Browser Info: Unknown

Steps to reproduce: 1. Login into the application Using "admin1" user 2. Navigate to search >> filter 3. Intercept the request using a proxy tool 4. Apply attack value in parameter Parameter: filters Attack Value: [{"property":"kind","values":["test"]},{"property":"'b) OR (1","values":["1'"]}

Actual results:

Expected results:

Additional info:

A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availability.

Description of problem: HTTP Strict Transport Security (HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header, it will prevent communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers.

Version-Release number of selected component (if applicable): 4.9

How reproducible:

Steps to Reproduce: 1. 2. 3.

Actual results:

Expected results: All data that is shared between windows must have explicit origins to avoid eavesdropping. It is recommended to avoid using "" for the "targetOrigin" in order to prevent a broadcast of the information. It is also important to validate any message that is received from another window.

Additional info:

The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red Hat OpenShift 4.9.

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.