-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Security Advisory

ARA-2020-003: Reverse tabnabbing

## Affected Product(s) and Environment(s)

Product: TeamBeam (Skalio GmbH) Version?
Environments: All browsers and operating systems

## Security Risk

Severity: High
Vulnerability Type: Use of Web Link to Untrusted Target with window.opener Access (CWE-1022)
CVSS v3: 3.1
## Impact
Confidentiality: Low
Integrity: None
Availability: None
## Exploitability
Access Vector: Network
Access Complexity: High
Privileges Required: None
User Interaction: Required
## Scope
Scope: Unchanged


## Remediation Level
Currently unavailable, awaiting manufacturer's response.


## Timeline
2020-05-13: Initial Vendor contact
2020-05-28: Vendor issues a fix


## Description Summary
Links to external Webpages are not secured by the noopener attribute.


## Product Introduction:
TeamBeam is a scaleable, flexible solution for secure business data exchange that is designed to meet your individual demands. [TeamBeam website](https://www.teambeam.de/)


## Technical Description
Hyperlinks to exteral sites are not secured properly and thus they are vulnerable to potential tabnabbing attacks.


## Solution
All hyperlinks on the TeamBeam application leading to external sites should be protected by the "rel" attribute with the value "noopener".


## References
[aramido responsible disclosure 
policy](https://aramido.de/blog/Sicherheitshinweise)


## Author
Tristan Wagner, aramido GmbH
E-mail: tristan.wagner@aramido.de
PGP-Key: https://aramido.de/tristan.wagner.asc
PGP-Fingerprint: 260A 1CBA 9472 6075 F05D DD11 6BF3 FEE3 AAE1 632A


## Disclaimer
The information provided in this advisory is provided "as is" without
any warranty. Details of this security advisory may be updated in order
to provide as accurate information as possible. The latest version of
this security advisory is available on the aramido web site. aramido
GmbH disclaims all warranties, either expressed or implied, including
the warranties of merchantability and capability for a particular
purpose. aramido GmbH or its suppliers are not liable in any case of
damage, including direct, indirect, incidental, consequential loss of
business profits or special damages, even if aramido GmbH or its
suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not
apply. We do not approve or encourage anybody to break any vendor
licenses, policies, deface websites, hack into databases or trade with
fraud/stolen material.


## Copyright
CC-BY-4.0
http://creativecommons.org/licenses/by/4.0/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE6GMZO9SOu//020sWLnuJprJNuOYFAl8FdMEACgkQLnuJprJN
uOY+lg/9GfykXg6FVkyrWtRR9nYS+TxSV2VvKIA2xXwxa4tgKMPp4yQT1XjU2f6W
MxfEVGyJTI3BByI32YvgVTam4A0yQbnWA5xIap+obUta4sEJTo7GRzh38xn70Yqf
TQqCaAa1BMDVQ7GBcZfq+JXEkaOxKdxbDF5a9AH/argcOdK2fBWvKOgY6v3ok+Ml
oVZAbYxexCW/fTMc2yQgquBI1Z5aZQZqzkHZkiEG64f58VbnQZDrg3nvxHwGaOLY
n1VkHn+tyJZU6DD7kGZH459Vl/Z2Xr2yX1oSauQ86+UZsoTrUFdV3KJmtOazUc+M
MYvbdRfcu0GTRpO6Cj/ud7EcTOnUQyaDnCBq2K359wlGJo3flz9wH7/lWO6lOeBv
4wEVbLSK6jf5sGDwcw+eMFOl3e2UO40C8yP8Jlww9zywTg65px00roqoWteml9zx
W/D1WBvMIGBDEB8l+nu8FZgVXu/bnY5sSwVOnwPmyZERO+n1bWT1nGVKuKptmLuB
eKrQB9GvKRRwJHW3aHvFTiOzNm2g2nadwHu+VWrDRDkEKvZgu0dm1ejzEnZfW3ra
SpJWFLtg7AeQULSobigJzUESxa/kYGGysg35u9J9XeRjPlmwhgAkFmxk8AhrzpUh
fCboUAiS/91Wr7ENZ9uhlU0DmrvredDWqfB4NV8dIADlpitn6Vo=
=9mTK
-----END PGP SIGNATURE-----