CWE-1022 UI Redress Attacks

Coverage: 3 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 2Other-pattern 1 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged a risk of UI redress: attackers manipulate what a user sees (or where they click) to make them perform unintended actions. Clickjacking via iframes is the common case, but overlays and deceptive UI flows also qualify.

Why it matters

UI redress can cause unintended actions or data disclosure.

• Unauthorized actions by tricking the user (approve, delete, transfer, grant access).
• Credential/consent theft when users interact with real UI elements in a deceptive context.
• Often paired with high-value endpoints (billing, admin, OAuth consent screens).

Safer examples

1) Prevent framing for sensitive pages

Use CSP frame-ancestors and X-Frame-Options (see CWE-1021 / CLICK01).

2) Add step-up confirmations for dangerous actions

Use explicit confirmations / re-auth / MFA for actions like changing email, transferring funds, or granting admin access.

3) Use anti-CSRF and verify intent server-side

UI defenses help, but the server should also verify the request is legitimate (see CWE-352).

How SiteShadow detects it (high level)

• Detects pages with sensitive actions lacking anti-framing protections.
• Flags flows where high-impact actions rely only on UI "visibility" or client-side gating.

References

• CWE-1022: https://cwe.mitre.org/data/definitions/1022.html

---

← Back to Vulnerability Library