1863
The web application produces links to untrusted external sites outside of its sphere of control,
but it does not properly prevent the external site from modifying security-critical properties of the
window.opener object, such as the location property.
Extended Description
When a user clicks a link to an external site ("target"), the target="_blank" attribute causes the
target site's contents to be opened in a new window or tab, which runs in the same process as the
original page. The window.opener object records information about the original page that offered
the link. If an attacker can run script on the target page, then they could read or modify certain
properties of the window.opener object, including the location property - even if the original and
target site are not the same origin. An attacker can modify the location property to automatically
redirect the user to a malicious site, e.g. as part of a phishing attack. Since this redirect happens in
the original window/tab - which is not necessarily visible, since the browser is focusing the display
on the new target page - the user might not notice any suspicious redirection.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 266 Incorrect Privilege Assignment 638
Applicable Platforms
Language : JavaScript (Prevalence = Often)
Technology : Web Based (Prevalence = Often)
Alternate Terms
tabnabbing :
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality Alter Execution Logic
The user may be redirected to an untrusted page that
contains undesired content or malicious script code.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
CWE Version 4.14
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access