CVE-2018-25058
Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing
In short
Twitter-Post-Fetcher opens links without protection against reverse tabnabbing, allowing malicious pages to access and control the original browser tab. This can be used to redirect users to phishing sites or steal session information.
Technical detail
The vulnerability exists in twitterFetcher.js Link Target Handler where links are opened without rel="noopener noreferrer" protection, enabling reverse tabnabbing attacks. An attacker can craft malicious tweets containing links that, when clicked, gain window.opener access to manipulate the original page. Affects Twitter-Post-Fetcher versions up to 17.x; fixed in 18.0.0.
Summary generated and translated by AI from the official description.
A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
n/a · Twitter-Post-FetcherWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →