Instacart · Report #227833
Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=
Summary
A reverse tab-nabbing link attack can be launched cause an evil link injection at www.instacart.com/store/partner_recipe?recipe_url=
Thanks to Karel Origin (https://twitter.com/Karel_Origin) for his report at https://hackerone.com/reports/196221, You made me think that more could be done, I owe you a beer :)
How it was found
Summary
Instacart at /store/partner_recipe?recipe_url= endpoint is vulnerable to reverse tabnabbing, since the injected link use target="_blank" , this means the page that opens in a new tab can access the initial tab and change its location using the window.opener property.
example: <a href="https://s3-eu-west-1.amazonaws.com/some-evil-host/evil2.html" target="_blank" class="">
Reproduction Steps & PoC
POC A
- Go to https://www.instacart.com/store/partner_recipe?recipe_url=https://s3-eu-west-1.amazonaws.com/some-evil-host/evil2.html&partner_name=&ingredients[]=apples&ingredients[]=butter&ingredients[]=Splenda+Brown+Sugar+Blend&ingredients[]=cinnamon&ingredients[]=nutmeg&title=Example-Reciper-with-Evil-Link&description=&image_url=x
- Click on "Example-Reciper-with-Evil-Link"
- You see that new page show 404 error and the principal page is change by a fake login page of instacart
Evil link {F183925} New open Page {F183924} Principal page changed for a phishing page {F183923}
POC B
1)Go to https://www.instacart.com/store/partner_recipe?recipe_url=https://s3-eu-west-1.amazonaws.com/some-evil-host/evil.html&partner_name=&ingredients[]=apples&ingredients[]=butter&ingredients[]=Splenda+Brown+Sugar+Blend&ingredients[]=cinnamon&ingredients[]=nutmeg&title=%22Barb%27s+Fried+Apples+-Diabetic-Low+Fat&description=&image_url=x 2) Click on "Example-Reciper-with-Evil-Link" 3) You see alert popup in instacart principal page
{F183926}
(Tested on all latest version browser: safari / chrome / firefox)
FIX & MITIGATION
To mitigate this issue we need to use rel="nofollow noopener noreferrer" as follows:
</a>```
Now when you click on this link, the attacker cannot access the initial tab.
#### References
**https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/**
Let me know if more info needed or anything else,
kind regards,
@ak1t4