9 ms·

The target=“_blank” vulnerability by example

131 points by prawn 10y ago

0xmohit 10y ago
- Interesting that this has been posted six times [0] over the past 4 days - Earlier discussion [1] on the same topic posted elsewhere [0] https://news.ycombinator.com/from?site=dev.to https://news.ycombinator.com/from?site=dev.to [1] https://news.ycombinator.com/item?id=11631292 https://news.ycombinator.com/item?id=11631292
amgin3 10y ago
Most organizations don't see this as a valid vulnerability. If you read terms of most bug bounty programs, they almost always specify that window.opener is out of scope.
andy_ppp 10y ago
Why on earth does target="_blank" expose window.opener to the new page - that opens up some mad tracking possibilities if you have JS in the opened page (e.g. Analytics or comments). Seems the default should be rel="noopener"...
- methyl 10y ago
  At least for cross-domain URLs.
- andy_ppp 10y ago
  I've worked out why this is allowed... if you middle click (open in a new tab) a pop up that uses a link (but intercepts the event by default) window.opener will still work in the new tab. The sibling is right, this should be same domain only.
helthanatos 10y ago
I wonder how much work it would take to get real information...
Kenji 10y ago
I followed the three steps below "To clarify" multiple times in different browsers and (3) did not work at all. I don't see the problem. This article has left me confused. EDIT: Oh, seems like Instagram has fixed this after all. If you inspect the link on his Instagram profile, you will find rel="nofollow me noopener noreferrer" and if you remove that attribute, it works just as described in the blog. I learned something new.
- jldteixeira 10y ago
  Seems to be fixed now. On Instagram the link has rel="nofollow me noopener noreferrer"
- kedean 10y ago
  As of right now, the exploit still works on Facebook. The article links to the example there.
endemic 10y ago
Wow, I never knew about this API. Seems very ripe for exploitation; check the referrer for an incoming request and route the other tab to a mirrored version of the site, on a host you control, preferably with a "you've been logged out due to inactivity, enter your credentials" modal.
endemic 10y ago
Another demo page, with links to open bugs in various browsers: https://mathiasbynens.github.io/rel-noopener/ https://mathiasbynens.github.io/rel-noopener/ (not all browsers implement the `rel="noopener"` attribute)

131 points by prawn 10y ago

- Interesting that this has been posted six times [0] over the past 4 days - Earlier discussion [1] on the same topic posted elsewhere [0] https://news.ycombinator.com/from?site=dev.to https://news.ycombinator.com/from?site=dev.to [1] https://news.ycombinator.com/item?id=11631292 https://news.ycombinator.com/item?id=11631292

amgin3 10y ago

Most organizations don't see this as a valid vulnerability. If you read terms of most bug bounty programs, they almost always specify that window.opener is out of scope.

andy_ppp 10y ago

Why on earth does target="_blank" expose window.opener to the new page - that opens up some mad tracking possibilities if you have JS in the opened page (e.g. Analytics or comments). Seems the default should be rel="noopener"...

methyl 10y ago
At least for cross-domain URLs.
andy_ppp 10y ago
I've worked out why this is allowed... if you middle click (open in a new tab) a pop up that uses a link (but intercepts the event by default) window.opener will still work in the new tab. The sibling is right, this should be same domain only.

helthanatos 10y ago

I wonder how much work it would take to get real information...

Kenji 10y ago

I followed the three steps below "To clarify" multiple times in different browsers and (3) did not work at all. I don't see the problem. This article has left me confused. EDIT: Oh, seems like Instagram has fixed this after all. If you inspect the link on his Instagram profile, you will find rel="nofollow me noopener noreferrer" and if you remove that attribute, it works just as described in the blog. I learned something new.

jldteixeira 10y ago
Seems to be fixed now. On Instagram the link has rel="nofollow me noopener noreferrer"
kedean 10y ago
As of right now, the exploit still works on Facebook. The article links to the example there.

endemic 10y ago

Wow, I never knew about this API. Seems very ripe for exploitation; check the referrer for an incoming request and route the other tab to a mirrored version of the site, on a host you control, preferably with a "you've been logged out due to inactivity, enter your credentials" modal.

endemic 10y ago

Another demo page, with links to open bugs in various browsers: https://mathiasbynens.github.io/rel-noopener/ https://mathiasbynens.github.io/rel-noopener/ (not all browsers implement the `rel="noopener"` attribute)