The target=“_blank” vulnerability by example(dev.to)
dev.to
The target=“_blank” vulnerability by example
https://dev.to/ben/the-targetblank-vulnerability-by-example
7 comments
Most organizations don't see this as a valid vulnerability. If you read terms of most bug bounty programs, they almost always specify that window.opener is out of scope.
Why on earth does target="_blank" expose window.opener to the new page - that opens up some mad tracking possibilities if you have JS in the opened page (e.g. Analytics or comments).
Seems the default should be rel="noopener"...
Seems the default should be rel="noopener"...
Wow, I never knew about this API. Seems very ripe for exploitation; check the referrer for an incoming request and route the other tab to a mirrored version of the site, on a host you control, preferably with a "you've been logged out due to inactivity, enter your credentials" modal.
Another demo page, with links to open bugs in various browsers: https://mathiasbynens.github.io/rel-noopener/ (not all browsers implement the `rel="noopener"` attribute)
I wonder how much work it would take to get real information...
I followed the three steps below "To clarify" multiple times in different browsers and (3) did not work at all. I don't see the problem. This article has left me confused.
EDIT: Oh, seems like Instagram has fixed this after all. If you inspect the link on his Instagram profile, you will find rel="nofollow me noopener noreferrer" and if you remove that attribute, it works just as described in the blog. I learned something new.
EDIT: Oh, seems like Instagram has fixed this after all. If you inspect the link on his Instagram profile, you will find rel="nofollow me noopener noreferrer" and if you remove that attribute, it works just as described in the blog. I learned something new.
As of right now, the exploit still works on Facebook. The article links to the example there.
Seems to be fixed now.
On Instagram the link has rel="nofollow me noopener noreferrer"
- Earlier discussion [1] on the same topic posted elsewhere
[0] https://news.ycombinator.com/from?site=dev.to
[1] https://news.ycombinator.com/item?id=11631292