Executive brief
HFS is a file-sharing application that allows administrators to add web links within the virtual filesystem. When these links are clicked, they open in a new browser tab but without security attributes that prevent the external site from controlling the original HFS page. An attacker who compromises a previously-safe linked website can redirect users back to a phishing page, potentially stealing HFS login credentials or other sensitive information, especially for users running older browsers.
Technical details
This vulnerability stems from missing rel="noopener noreferrer" attributes on hyperlinks opened with target="_blank". When external links lack these attributes, the opened page can access the window.opener property and change the location of the originating tab. The vulnerability requires an attacker to compromise a third-party website that an HFS administrator has legitimately linked to; no compromise of the HFS admin account itself is necessary. Attack preconditions include the user clicking the malicious link and running an older browser without built-in protections (most modern browsers have mitigated this at the browser level). The fix was released in HFS version 0.57.10, which adds the required rel="noopener noreferrer" attributes to external links.
Affected products
- rejetto HFS before 0.57.10
Timeline
- 2025-08-12: disclosed
- 2025-08-12: patched: Fixed in version 0.57.10