Insecure by default – hijacking websites that use target=“_blank”

Re:Insecure by default – hijacking websites that use target=... by yeldarb on Wednesday October 05, 2016 @03:14PM (#12646838)

Does it actually work cross domain? That would really surprise me.

Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?

[ Parent | on HN ]

Re:Insecure by default – hijacking websites that use target=... by aji on Wednesday October 05, 2016 @03:27PM (#12646959)

I don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files

link.html:

    <a id="link" href="opener.html" target="_blank">Click</a>

opener.html:

    <script>window.opener.document.getElementById("link").href = "https://google.com";</script>

and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?

[ Parent | on HN ]

Re:Insecure by default – hijacking websites that use target=... by Retr0spectrum on Wednesday October 05, 2016 @03:31PM (#12646999)

See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810

It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.

[ Parent | on HN ]

Re:Insecure by default – hijacking websites that use target=... by magicalist on Wednesday October 05, 2016 @03:36PM (#12647038)

you cannot access the opener's document as aji's example does cross origin

[ Parent | on HN ]

Re:Insecure by default – hijacking websites that use target=... by Retr0spectrum on Wednesday October 05, 2016 @03:41PM (#12647080)

Sorry, I didn't read the comment carefully enough.

I assumed we were still talking about window.opener.location (which can be modified across domains)

[ Parent | on HN ]