2012-11-26 Instructure Advisory IAC44596 - Clickjacking Vulnerability

588

SECURITY UPDATE

Release Date:	2012-11-26 (Last update can be found below the document title)
Description:	Clickjacking Vulnerability
Criticality Level:	Moderately Critical ( Less Critical < Critical < Moderately Critical < Highly Critical )
Impact:	Potential for an attacker to deceive users into performing actions by crafting a malicious third party web page
Systems Affected:	Canvas LMS
Solution Status:	Fixed in Canvas Cloud
Discovered By:	Himanshu Kumar Das
Relevant Changesets:	Canvas: https://github.com/instructure/canvas-lms/commit/6ec1f7097348a936f3fa73ff5652c7071f8441bf

Summary:

Because Canvas was not protecting itself against being embedded in an iframe on another domain, it was possible for an attacker to craft a clickjacking attack (https://www.owasp.org/index.php/Clickjacking), tricking a user into performing an action in Canvas unintentionally.

Status:

Fixed in Canvas Cloud. Canvas CV users are encouraged to either update to the most recent stable code, apply the patch manually, or run the following command in a script/console session and restart canvas web processes:

Setting.set('block_html_frames', 'true')

About

Bio

Jordan has had various roles in the ed tech software (SAAS) industry for the past 9 years. (almost 5 years with Instructure). In his previous company he was a Client Services Manager for two years (responsible for account management, implementation, project management, and training, for each of his customers). After a year and a half he was commissioned to build a training department, all policies and procedures, and deliver training for all customers. Over the past eight years he has been in charge of conceiving, producing and deploying eLearning initiatives and strategies. He has trained over 3,000 adult learners with a wide range of technical aptitude, including K-12 Teachers, Principals, Administrators, Superintendents, Higher Ed Professors, Doctors, CTO’s, and Corporate Business Professionals and Executives. Jordan is an instructional designer and Community Manager for Instructure with a focus on connecting Canvas users with tools and resources that will help them get excited about and become proficient in utilizing the Canvas Learning Platform.