TabNabbing issue (due to taget=_blank)

Disclosed: 2017-08-16 04:58:46 By gujjuboy10x00 To legalrobot
Unknown
Vulnerability Details
Hi team, i get to know in this particular url https://app.legalrobot-uat.com/dmca-safe-harbor and i found one 3rd party url. Issue lies Here : ``` <a href="https://eff.org" target="_blank">Electronic Frontier Foundation</a> ``` Here i can see you are using target=_blank and no more rel tag. Here , target=_blank means it will open in another new tab. but due to tabnabbing it can change parent tab as well (Legalrobot). so as per security principal , don't trust much on 3rd party. and be at your safe sight, i can recommend you to add rel="noreferer, ,noopener" to avoid this issue. So final tag for that particular anchor tag will be: `` <a href="https://eff.org" target="_blank" rel="norefere,noopener">Electronic Frontier Foundation</a> ``` more safe !! Please let me know for more information. Thanks, Vishal
Actions
View on HackerOne
Report Stats
  • Report ID: 260278
  • State: Closed
  • Substate: resolved
  • Upvotes: 13
Share this report