CVE-2019-25155

Vulnerability

Overview DOMPurify versions prior to 1.0.11 contain a reverse tabnabbing vulnerability in the demo page demos/hooks-target-blank-demo.html. The page includes links with target="_blank" but lacks the rel="noopener noreferrer" attribute, allowing an opened page to access the original page's window.opener object and potentially redirect it to a malicious site [1][2].

Attack

Vector To exploit this, an attacker needs to host a malicious page that is linked from the demo page. When a user clicks the link, the malicious page opens in a new tab and can use window.opener.location to navigate the original page to a phishing or harmful website. No authentication is required, and the vulnerability is present only in the demo file, not in the core sanitization library [3].

Impact

Successful exploitation allows an attacker to perform reverse tabnabbing, tricking users into visiting malicious sites while they believe they are still on the legitimate DOMPurify demo. This can lead to phishing, malware distribution, or other social engineering attacks [1].

Mitigation

The vulnerability was fixed in version 1.0.11 by adding rel="noopener noreferrer" to the affected links [4]. Users should update to the latest version or avoid using the demo page in production environments.