WSTG - Latest

Reverse Tabnabbing

ID
WSTG-CLNT-14

Summary

Reverse Tabnabbing is an attack which can be used to redirect users to phishing pages. This usually becomes possible due to the target attribute of the <a> tag being set to _blank which causes the link to be opened in a new tab. When the attribute rel='noopener noreferrer' is not used in the same <a> tag, the newly opened page can influence the original page and redirect it to a domain controlled by the attacker.

Since the user was on the original domain when the new tab opened, they are less likely to notice that the page has changed, especially if the phishing page is identical to the original domain. Any credentials entered on the attacker-controlled domain will thus end up in the attacker’s possession.

Links opened via the window.open JavaScript function are also vulnerable to this attack.

NOTE: Modern browsers treat links with target="_blank" as if rel="noopener" were set, so plain links are only vulnerable in older browsers (for example, versions prior to Google Chrome 88). Links with rel="opener", and pages opened with window.open() without the noopener window feature, are still vulnerable in modern browsers.

Example

Imagine a web application where users are allowed to insert a URL in their profile. If the application is vulnerable to reverse tabnabbing, a malicious user will be able to provide a link to a page that has the following code:

<html>
 <body>
  <script>
    window.opener.location = "https://example.org";
  </script>
<b>Error loading...</b>
 </body>
</html>

Clicking on the link will open up a new tab while the original tab will redirect to “example.org”. Suppose “example.org” looks similar to the vulnerable web application, the user is less likely to notice the change and is more likely to enter sensitive information on the page.

Test Objectives

Identify links and window.open() calls that open a new tab or window without noopener.
Assess whether a page opened from the application can change the location of the original page through window.opener.

How to Test

Check the HTML source of the application to see if links with target="_blank" are using the noopener and noreferrer keywords in the rel attribute. If not, it is likely that the application is vulnerable to reverse tabnabbing. Such a link becomes exploitable if it either points to a third-party site that has been compromised by the attacker, or if it is user-controlled. Also check JavaScript code for window.open() calls that do not pass noopener in the window features.
Check for areas where an attacker can insert links, i.e. control the href argument of an <a> tag. Try to insert a link to a page which has the source code given in the above example, and see if the original domain redirects. In modern browsers, this only works for links with rel="opener" or pages opened with window.open(); testing a plain target="_blank" link requires an older browser.

Remediation

It is recommended to make sure that the rel HTML attribute is set with the noreferrer and noopener keywords for all links, and that window.open() calls pass noopener in the window features.

References

Watch Star