Current Situation / Problem Statement
During a recent vulnerability assessment of the ScienceLogic SL1 platform, the security team identified finding FND-295942 – Unsafe Third-Party Link (target="_blank" without noopener/noreferrer).
The assessment found that certain links within the SL1 web application open external pages in a new browser tab or window using the target="_blank" attribute without implementing the recommended security controls rel="noopener noreferrer".
This behavior may allow the newly opened page to access the originating window through the browser's window.opener functionality, creating a potential security risk and resulting in repeated vulnerability findings during security scans.
Proposed Solution
Update all SL1 web application hyperlinks that use target="_blank" to include:
Additionally:
- Review all external and third-party links across the SL1 UI.
- Implement secure coding standards for future development.
- Include the validation of
noopenerandnoreferrerattributes as part of security testing and code reviews.
Benefits
- Addresses security finding FND-295942.
- Reduces the risk of reverse tabnabbing and unauthorized access through
window.opener. - Improves compliance with industry security best practices (OWASP and modern browser security recommendations).
- Reduces recurring vulnerability remediation efforts for SL1 customers.
- Enhances overall application security posture and customer confidence.
Business Impact
Failure to address this issue may result in repeated vulnerability findings during customer security assessments, increased remediation effort, compliance concerns, and potential delays in security approval processes for SL1 deployments.