Executive brief
Quill is a popular rich text editor library used in web applications. The library uses HTML anchor tags with target="_blank" to open links in new tabs without properly securing them, allowing attackers to redirect the original page to a phishing site when users click links. This vulnerability can be exploited for phishing attacks and session hijacking.
Technical details
This is a reverse tabnabbing vulnerability (CWE-1022) in the anchor tag creation logic of Quill's link format handler. When Quill renders links with target="_blank", it fails to set the rel="noopener noreferrer" attribute, which normally prevents the opened page from accessing the window.opener object. An attacker-controlled destination page can use window.opener to redirect the original tab to a malicious phishing page. The vulnerability is exploitable in both normal editing mode and read-only display mode where users click embedded links. No user privilege or authentication is required; only user interaction (clicking a link) is needed. The fix involves adding rel="noopener noreferrer" to anchor tags created by the formats/link.js module. Version 1.3.7 and later contain the patch.
Affected products
- Quill Quill < 1.3.7
Timeline
- 2020-09-03: disclosed