CWE-1021 (不当限制渲染UI层或帧) — Vulnerability Class 110

CWE-1021 represents a critical web application weakness where the system fails to properly restrict frame objects or user interface layers belonging to external applications or domains. This vulnerability is typically exploited through clickjacking attacks, where malicious actors embed the target application within an invisible or deceptive iframe on a different domain. By tricking users into interacting with hidden UI elements, attackers can perform unauthorized actions, such as transferring funds or changing account settings, without the user’s explicit consent or awareness. To mitigate this risk, developers must implement robust security headers, specifically the Content-Security-Policy (CSP) frame-ancestors directive, which explicitly defines which origins are permitted to embed the application. Additionally, setting the X-Frame-Options header to DENY or SAMEORIGIN provides an effective defense by preventing the browser from rendering the page within any frame unless it originates from the same domain, thereby neutralizing the attack vector.