4 ms·

Insecure by default – hijacking websites that use target=“_blank”

46 points by obi1kenobi 10y ago

Raphmedia 10y ago
Can anyone explain how this works?
- ge96 10y ago
  Perhaps try stack overflow or /r/webdev I too want to know
- tinus_hn 10y ago
  The problem is that a document in a window opened by a link with target="_blank" unexpectedly has a reference to the document that contains the link, using the window.opener property. This property has limited functionality but one of the things that are allowed is redirecting the page to something else which is kind of unexpected. The problem is not websites that use target="_blank", it's browsers that refuse to fix this behavior because of some ill-defined compatibility issue that appears to exist mostly in the heads of developers who don't want to work on a fix.
nthitz 10y ago
Previous discussion on the same vulnerability https://news.ycombinator.com/item?id=11631292 https://news.ycombinator.com/item?id=11631292
Retr0spectrum 10y ago
This is a nice demonstration, although I feel like it would be more useful to show that it works across domains (Which IMHO is the most important part).
- aji 10y ago
  Yeah, having never heard of this before, I'm a little shocked. Can you access things like window.opener.document? Fortunately, tabs created by opening the link using the middle mouse button don't seem to have a useful window.opener. Guess I'll be more deliberate about that habit.
- yeldarb 10y ago
  Does it actually work cross domain? That would really surprise me. Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?
  - aji 10y ago
    I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files link.html: <a id="link" href="opener.html" target="_blank">Click</a> opener.html: <script>window.opener.document.getElementById("link").href = "https://google.com";</script> and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?
    - Retr0spectrum 10y ago
      See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810 https://news.ycombinator.com/item?id=11631810 It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.
      - magicalist 10y ago
        you cannot access the opener's document as aji's example does cross origin
        Retr0spectrum 10y ago
        Sorry, I didn't read the comment carefully enough. I assumed we were still talking about window.opener.location (which can be modified across domains)
milankragujevic 10y ago
AFAIK, Many (pirate) websites now use this technique to hijack the previous tab and show ads even if you have an adblocker, and open their links in new tabs always.

46 points by obi1kenobi 10y ago

Raphmedia 10y ago

Can anyone explain how this works?

ge96 10y ago
Perhaps try stack overflow or /r/webdev I too want to know
tinus_hn 10y ago
The problem is that a document in a window opened by a link with target="_blank" unexpectedly has a reference to the document that contains the link, using the window.opener property. This property has limited functionality but one of the things that are allowed is redirecting the page to something else which is kind of unexpected. The problem is not websites that use target="_blank", it's browsers that refuse to fix this behavior because of some ill-defined compatibility issue that appears to exist mostly in the heads of developers who don't want to work on a fix.

nthitz 10y ago

Previous discussion on the same vulnerability https://news.ycombinator.com/item?id=11631292 https://news.ycombinator.com/item?id=11631292

Retr0spectrum 10y ago

This is a nice demonstration, although I feel like it would be more useful to show that it works across domains (Which IMHO is the most important part).

aji 10y ago
Yeah, having never heard of this before, I'm a little shocked. Can you access things like window.opener.document? Fortunately, tabs created by opening the link using the middle mouse button don't seem to have a useful window.opener. Guess I'll be more deliberate about that habit.
yeldarb 10y ago
Does it actually work cross domain? That would really surprise me. Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?
- aji 10y ago
  I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files link.html: <a id="link" href="opener.html" target="_blank">Click</a> opener.html: <script>window.opener.document.getElementById("link").href = "https://google.com";</script> and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?
  - Retr0spectrum 10y ago
    See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810 https://news.ycombinator.com/item?id=11631810 It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.
    - magicalist 10y ago
      you cannot access the opener's document as aji's example does cross origin
      - Retr0spectrum 10y ago
        Sorry, I didn't read the comment carefully enough. I assumed we were still talking about window.opener.location (which can be modified across domains)

milankragujevic 10y ago

AFAIK, Many (pirate) websites now use this technique to hijack the previous tab and show ads even if you have an adblocker, and open their links in new tabs always.