HexBrain

Monero · Report #265160

TabNabbing issue (due to taget=_blank)

Validstatus
11upvotes
25 Apr 2018disclosed

How it was found

Hi team,

i get to know in this particular url https://getmonero.org/get-started/what-is-monero/ and i found one 3rd party url.

Issue lies Here :

<a href="https://www.openhub.net/p/monero" target="_blank">

Here i can see you are using target=_blank and no more rel tag. Here , target=_blank means it will open in another new tab. but due to tabnabbing it can change parent tab as well . so as per security principal , don't trust much on 3rd party. and be at your safe sight,

i can recommend you to add rel="noreferer, ,noopener" to avoid this issue.

So final tag for that particular anchor tag will be:

<a href="https://www.openhub.net/p/monero" target="_blank rel="norefere,noopener" type="link">

Thanks,

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original