Common Weakness Enumeration

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

When a user clicks a link to an external site ("target"), the target="_blank" attribute causes the target site's contents to be opened in a new window or tab, which runs in the same process as the original page. The window.opener object records information about the original page that offered the link. If an attacker can run script on the target page, then they could read or modify certain properties of the window.opener object, including the location property - even if the original and target site are not the same origin. An attacker can modify the location property to automatically redirect the user to a malicious site, e.g. as part of a phishing attack. Since this redirect happens in the original window/tab - which is not necessarily visible, since the browser is focusing the display on the new target page - the user might not notice any suspicious redirection.

该表显示了与该弱点相关的弱点和高级类别。这些关系定义为childof，parentof，ementof，并深入了解可能存在于较高和较低抽象水平的类似项目。此外，定义了诸如Peerof和Canalsobe之类的关系，以显示用户可能想要探索的类似弱点。

This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Technologies

中等的

Example 1

In this example, the application opens a link in a named window/tab without taking precautions to prevent the called page from tampering with the calling page's location in the browser.

通常有两种方法可以看到这种弱点。第一个是当应用程序生成标签与target =“ _ blank”指向目标站点时：

如果攻击者在此链接上提供了有用的页面（或损害了受信任的流行站点），则用户可以单击此链接。但是，攻击者可以使用脚本代码修改窗口。开放器的位置属性将应用程序重定向到恶意，攻击者控制的页面 - 例如模仿原始应用程序的外观和感觉的页面，并说服用户重新输入。身份验证证书，即网络钓鱼：

(attack code)

Example Language:JavaScript

window.opener.location ='http://phishing.example.org/popular-bank-page';

为了减轻这种类型的弱点，一些浏览器支持具有“ noopener”值的“ rel”属性，该属性设置了窗口。开机对象等于null。另一个选择是将“ rel”属性与“ noreferrer”的值一起使用，从本质上讲，该属性可以使用相同的事情。

通常看到这种弱点的第二种方法是直接在JavaScript中打开新站点时。在这种情况下，使用window.open（）函数打开一个新站点。

（不良代码）

Example Language:JavaScript

var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");

To mitigate this, set the window.opener object to null.

(good code)

Example Language:JavaScript

var newWindow = window.open("http://attacker-site.example.com/useful-page.html", "_blank");
newWindow.opener = null;