Cognos is vulnerable to clickjacking through direct dispatcher URL

Product or Service: Cognos Connection 10.2.1
Component ID: 5724W12CC
.
Operating System: Windows (Microsoft)
.
Problem title
:- Cognos is vulnerable to clickjacking through direct dispatcher URL
.
Problem description and business impact
Summary:- Cognos is vulnerable to clickjacking through direct
dispatcher URL. Disable/reject direct dispatcher URL access for
clickjacking.


Details:-
Cognos 10.2.1 IF8 is vulnerable to clickjacking through direct
dispatcher URL. Disable/reject direct dispatcher URL access for
clickjacking.

Note:- Web server is already disable for clickjacking as suggested
below. PMR 06735,004,000.


The suggestion by the testcase team was
- that when accessing Cognos , the dispatcher url is not an intended
access point
- To access the Cognos environment is with a Web or Servlet gateway
that has the clickjacking protection, which the you have done with the
'X-Frame-Options SAMEORIGIN'
- the test currently in place is a broadcast or systematic attack to
access all servers and ports to see when a login screen appears and to
have the user login successful, to capture the information.
- We cannot limit the URL that users people will be attempting to
access, but only limit with the client policy.
- To address the clickjacking vulnerability we use the existing web
server or SSL configuration. What you can do is add SSL certificates on
the dispatcher to block the clickjacking attempts.

Also you can raise enhancement request to reject direct dispatcher URL
access for clickjacking.

The out of the box suggestions provided earlier on call was to
- apply ACL in environment to restrict user access to Dispatcher URL
- use firewalls to prevent access to dispatcher port

Thanks & Regards,
Sujata Y