HexBrain

HackerOne · Report #1159398

New link opening method makes hackerone vulnerable to tabnabbing

Validstatus
lowseverity
51upvotes
7 Jul 2021disclosed

How it was found

Summary: Hackerone recently changed how it opens the external links and this new way is vulnerable to tabnabbing. Description: Please see the POC.

Steps To Reproduce

  1. Click here: https://awasthi7.github.io/
  2. Click on proceed when warning appears.
  3. The site will open in new tab and hackerone tab will be replaced by Google.

Optional: Your Environment (Browser version, Device, etc)

Optional: Supporting Material/References (Screenshots)

Impact

Unvalidated redirect

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original