HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

Description

When adding a “web link” to the HFS virtual filesystem, the frontend opens it with target="_blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab.

Recommendation

Update the hfs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.57.9
• Patched version(s): 0.57.10

References

• GHSA-xcxh-6cv4-q8p8
• CWE-1022

Related Issues

• Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access - CVE-2018-25058
• Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
• Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation - materialize-css - CVE-2019-11004
• Unsanitized user controlled input in module generation - Vulnerability

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

14 Software Security Terms You Should Know

Tags:

npm

hfs