CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
Presentation Filter:
 DescriptionThe web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property. Extended DescriptionWhen a user clicks a link to an external site ("target"), the target="_blank" attribute causes the target site's contents to be opened in a new window or tab, which runs in the same process as the original page. The window.opener object records information about the original page that offered the link. If an attacker can run script on the target page, then they could read or modify certain properties of the window.opener object, including the location property - even if the original and target site are not the same origin. An attacker can modify the location property to automatically redirect the user to a malicious site, e.g. as part of a phishing attack. Since this redirect happens in the original window/tab - which is not necessarily visible, since the browser is focusing the display on the new target page - the user might not notice any suspicious redirection. Alternate Terms
RelationshipsThe table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Research Concepts" (CWE-1000)
Modes Of IntroductionThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
Applicable PlatformsThe listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance. Languages JavaScript (Often Prevalent) Technologies Class: Web Based (Often Prevalent) Common ConsequencesThe table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Likelihood Of ExploitMedium Demonstrative ExamplesExample 1 In this example, the application opens a link in a named window/tab without taking precautions to prevent the called page from tampering with the calling page's location in the browser. There are two ways that this weakness is commonly seen. The first is when the application generates an <a> tag is with target="_blank" to point to a target site: (bad code) Example Language: HTML <a href="http://attacker-site.example.com/useful-page.html" target="_blank">
If the attacker offers a useful page on this link (or compromises a trusted, popular site), then a user may click on this link. However, the attacker could use scripting code to modify the window.opener's location property to redirect the application to a malicious, attacker-controlled page - such as one that mimics the look and feel of the original application and convinces the user to re-enter authentication credentials, i.e. phishing: (attack code) Example Language: JavaScript window.opener.location = 'http://phishing.example.org/popular-bank-page';
To mitigate this type of weakness, some browsers support the "rel" attribute with a value of "noopener", which sets the window.opener object equal to null. Another option is to use the "rel" attribute with a value of "noreferrer", which in essence does the same thing. (good code) Example Language: HTML <a href="http://attacker-site.example.com/useful-page.html" target="_blank" rel="noopener noreferrer">
A second way that this weakness is commonly seen is when opening a new site directly within JavaScript. In this case, a new site is opened using the window.open() function. (bad code) Example Language: JavaScript var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");
To mitigate this, set the window.opener object to null. (good code) Example Language: JavaScript var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");
newWindow.opener = null; Potential Mitigations
References
Content History
More information is available — Please select a different filter. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006-2021, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. |
|
