Passbolt Api Tabnabbing Vulnerability
Summary
GHSA-qm5v-pj64-852j: Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab". Affects passbolt/passbolt_api versions < 2.11.0. Fixed in 2.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Passbolt Api is an open-source password manager that allows users to securely store and share passwords. It provides an API for managing passwords and resources. The Passbolt Api package is part of the Packagist ecosystem and is used by developers to integrate Passbolt functionality into their applications.
Vulnerability Detail
The Passbolt Api is vulnerable to Tabnabbing attacks. This vulnerability allows a user to create and share a resource with a malicious URI. When the victim opens the URI with the 'Open URI in a new tab' function, the malicious page gains access to the window.opener object. This can lead to various malicious actions, such as redirecting the user to a phishing page or manipulating data integrity.
How To Fix
Minimum fixed version
2.11.0
This is the first release that contains the fix.
composer require passbolt/passbolt_api:2.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to Passbolt Api version 2.11.0 or later to mitigate the risk.
Conclusion
The Passbolt Api Tabnabbing vulnerability allows for potential phishing attacks and data manipulation. It is crucial to update to Passbolt Api version 2.11.0 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for passbolt/passbolt_api →
FAQ
Passbolt Api is an open-source password manager that provides an API for managing passwords and resources.
Tabnabbing is a type of phishing attack where a malicious page changes the window.opener.location or performs actions on behalf of the user.
The impact of this vulnerability is that a malicious page can redirect the user to a phishing page or manipulate data integrity.
To fix this vulnerability, update to Passbolt Api version 2.11.0 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Passbolt Api.
References
Related vulnerabilities
Recent vulnerabilities recorded for passbolt/passbolt_api.
