software composition analysis
Product
SAST
Catch vulnerabilities as you develop DAST
Test live web applications like an attacker SCA
Secure open-source and supply chain MAST
Secure mobile apps from code to store Compliance
Align with standards while shipping secure code
Resources
Vulnerability database Healthy Package
Blog News
Documentation
Pricing Partners About Us Log In
software composition analysis

Java : Unsafe target link

Classification

OWASP Top 10 2017 A6-Security Misconfiguration OWASP Top 10 2021 A4-Insecure Design A5-Security Misconfiguration PCI DSS 4.0 7.2.6 HIPAA §164.312 (a)(1) CWE CWE-266 CWE-1022

Overview

The application uses links with the attribute target="_blank", which allows you to load the page by reference in a new browser window. The loaded page accesses the source page through the window.opener object. Without setting restrictions on changes to the properties of the window.opener object, it is possible to redirect the user to a phishing site.

References

  1. CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
  2. OWASP Top 10 2017-A6-Security Misconfiguration
  3. Target=“_blank” - the most underestimated vulnerability ever

See also

Java : Deprecated class InvokerServlet
Java : Method clone() without Cloneable interface
Java : SecurityManager overridable check