Listen to this Post
How the CVE Works
The vulnerability arises when HFS adds a web link without the `rel=”noopener noreferrer` attribute, allowing malicious pages opened via `target=”_blank”` to manipulate the original tab using window.opener. Attackers can redirect the HFS admin interface to a phishing page if a trusted linked site is later compromised. While modern browsers mitigate this, outdated browsers remain vulnerable.
DailyCVE Form
Platform: HFS
Version: <2.4
Vulnerability: Tabnabbing
Severity: Medium
Date: 2023-07-15
Prediction: Patch by 2023-09-30
What Undercode Say
<script> window.opener.location = "https://malicious.site"; </script>
Check browser version for vulnerability navigator.userAgent
How Exploit
- Admin adds a malicious web link in HFS.
- User clicks the link, opening a new tab.
- Malicious tab redirects the original HFS tab to a phishing page.
Protection from this CVE
- Update HFS to v2.4+.
- Manually add `rel=”noopener noreferrer` to links.
- Use modern browsers (Chrome ≥88, Firefox ≥79).
Impact
- Credential theft via phishing.
- Session hijacking for unpatched browsers.
- Low risk for updated browsers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
