Reverse tabnabbing allowing phishing attacks | AEM

Reverse tabnabbing allowing phishing attacks | AEM

Išči
Experience Manager Navodila za uporabo

Na tej strani

Velja za: Experience Manager

某些 Creative Cloud 应用程序、服务和功能在中国不可用。

Question

Reverse tabnabbing allows phishing attacks by using the external links from AEM. For example, the links to the documentation from the "?" symbol.
Is it a serious threat and what to do to avoid that?

Answer

Reverse tabnabbing is out of the scope of AEM threat-model as it is a browser issue, which cannot be easily mitigated at the product level.
The following quote from Google security explains this issue:

Unfortunately, we believe that this class of attacks is inherent to the current design of web browsers and can't be meaningfully mitigated by any single website; in particular, clobbering the window. opener property limits one of the vectors but still makes it easy to exploit the remaining ones.

Additional information

https://sites.google.com/site/bughunteruniversity/nonvuln/phishing-with-window-opener.