@ThePracticalDev pointed out an attack vector allowing phishing with <a> tags with a target="_blank" attribute, but without rel="noopener noreferrer" attribute.
MediaWiki gadget "Open external links in a new tab or window" is adversely affected on Firefox 47.0.1 (haven't checked on 48 yet) and Chrome 52.0.2743.116 m (latest to date).
Reproduce :
- Have the "Open external links in a new tab or window" gadget active, as a logged-in user obviously.
- Create a link to https://dev.to and preview (or publish, but I'd suggest not on a public wiki :-D )
- Click on that link. It opens in a new browser tab
- Go back to the tab you're coming from (by closing the new tab or by clicking on the old tab, it doesn't matter)
- The old tab has either changed to the resource at https://dev.to/phishing (inoffensive, merely explaining the issue) if you've published, or asked if you want to close it if you've opted for a preview - meaning a window.location tried occurring but was blocked because of the form element : allowing it brings you to the same resource.
You can also reproduce "in a vacuum", thanks to @Platonides : https://servidor.wikimedia.es/go-phishing.html Click on the "go phishing" link in that page.
It can be used as an attack vector if the remote website forces window.opener.location to a seemingly innocuous page (for instance a page that looks like the main page of the wiki you're coming from, or the actual page you're coming from on that wiki if there is only one link to the specific resource that was linked), which resides in fact on a website of the attacker. Any link on that seemingly innocuous page could point to a page that looks identical to a MediaWiki login page, in which the unsuspecting user would gladly fill in their credentials. The attacker only has to store those credentials and be on its merry way.
Granted, the "Open external links in a new tab or window" gadget may not be the most used ; but it is used nonetheless, if anything by me - and I'd really hate to see what effects could arise from that kind of attack used on an account (or accounts) with special permissions.
Proposed patch :
In https://en.wikipedia.org/wiki/MediaWiki:Gadget-exlinks.js (and other WMF wikis at least) and https://www.mediawiki.org/wiki/Snippets/Open_external_links_in_new_window, after this.target = '_blank';, add :
if ( !this.rel.indexOf( 'noopener' ) < 0 ) {
this.rel += ' noopener'; // the leading space matters, rel attributes have space-separated tokens
}
if ( !this.rel.indexOf( 'noreferrer' ) < 0 ) {
this.rel += ' noreferrer'; // the leading space matters, rel attributes have space-separated tokens
}This should prevent any event relying on that strange yet common browser behaviour.
Thanks :-)