3

Basically, I am having an <a> tag with target set to _blank, where an attacker has control over the href parameter, thus possible inserting a javascript tag, like the following:

<a target="_blank" href="javascript:alert(document.location)">

However, this XSS executes in a new about:blank tab because of the target setting.

Is it possible to bypass this, and let the javascript execute on the original page with the control of the href parameter?

  • 1
    Why cant they just close the <a> tag and begin a new tag? – Vipul Nair Aug 28 '19 at 19:21
  • is the opener property available to the popup code? – dandavis Aug 28 '19 at 19:28
  • 1
    What characters (if any) are escaped? Are we assuming proper attribute escaping? – Gray Aug 28 '19 at 20:29
2

You can use window.opener to exploit this (fiddle):

<a target="_blank" href="javascript:alert(window.opener.document.cookie);">test</a>

Or if you can escape the attribute value context, you can start a new script tag or a new attribute like onMouseEnter.

1

Use a data: URI. Data URIs let you encode arbitrary content (including HTML and JS), with a content type of your choice, into a URL. They don't (inherently) cause a network request; the browser just loads the content directly. In the scenario you have here, you would then be able to use the window.opener property (within the new page) to drive the vulnerable site. Windows (including iframes, and probably new tabs) that load Data URIs don't create a new origin - they inherit the origin of the page that they are loaded from - so you should have full access to the opener's DOM and be able to make same-origin XHR/Fetch requests (with authentication/cookies and access to responses) to the domain.

Of course, all this assumes you cannot just break out of the "href" attribute to add a new attribute (such as an event handler, which would fire on the existing tab not the new location), or out of the anchor element entirely and add your own element (such as a script tag).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.