TabNabbing issue (due to taget=_blank)
Unknown
Vulnerability Details
Hi team,
i get to know in this particular url
https://app.legalrobot-uat.com/dmca-safe-harbor and i found one 3rd party url.
Issue lies Here :
```
<a href="https://eff.org" target="_blank">Electronic Frontier Foundation</a>
```
Here i can see you are using target=_blank and no more rel tag.
Here , target=_blank means it will open in another new tab. but due to tabnabbing it can change parent tab as well (Legalrobot).
so as per security principal , don't trust much on 3rd party. and be at your safe sight,
i can recommend you to add rel="noreferer, ,noopener" to avoid this issue.
So final tag for that particular anchor tag will be:
``
<a href="https://eff.org" target="_blank" rel="norefere,noopener">Electronic Frontier Foundation</a>
```
more safe !!
Please let me know for more information.
Thanks,
Vishal
Actions
View on HackerOneReport Stats
- Report ID: 260278
- State: Closed
- Substate: resolved
- Upvotes: 13