Nextcloud · Report #3367676
tabnabbing in roundcube webmail
How it was found
Description: Tab nabbing vulnerability occurs When you open a link in a new tab ( target="_blank" ), the page that opens in a new tab can access the initial tab and change its location using the window.opener property and from this a lot of phishing attacks could happen. This scenario occurs on roundcube webmail. Attack Scenario: The attacker will create any website with any content which include this script tag.
<script> if (window.opener) window.opener.parent.location.replace('http://phishing.com'); if (window.parent != window) window.parent.location.replace('http://phishing.com'); </script>Steps To Reproduce:
-
Login into your roundcube webmail account.
-
Go to Compose option and below you can see there is open in the new window button click it.
-
Open the console and write window.opener.location='http://google.com'.
-
Return to the round webmail account and you will redirect to Google.com.
Thank You,
Waleed Anwar
Impact
Impact Due to the redirection being done in the background and most people aren't aware of this type of attack unlike the open redirection, Most people will fall into it and will enter their credentials leading to account takeover.