Websites opened from reports can change url of report page

How it was found

Websites opened from the a hackerone report can change the url of the report page. For example, clicking on a link set to "http://d214mfsab.org/same.html" (including this one) will change the still-open report page to http://example.com. This works on current versions of Safari (including mobile) and possibly other browsers.

This vulnerability can lead to phishing attacks, where the user changes the url of the report page to a similar-looking page. Users would trust the tab with the report open to remain the same, and would be unsuspecting.

This is due to mishandling of the 'target="_blank"' option.

To reproduce:

1. In any html page (does not need to be the same origin), add the javascript "opener.location = 'http://example.com'". For this, I created http://d214mfsab.org/same.html
2. Add this url to a hackerone report.
3. When a user clicks on this url, the original report page's url will be changed to a potentially malicious url.

A malicious user could modify the report page to an extremely similar page, which a user would be unlikely to notice. An attacker could duplicate the entire report page, and present a login form, which would steal the user's password.

Although the user is warned about following links, this is not sufficient protection, as hackerone should ensure that pages cannot modify the report url.