Link manipulation (reflected DOM-based)
Summary: Reflected DOM-based vulnerabilities occur when data from a request is echoed into the application's immediate response in a part of the DOM that a client-side script then processes unsafely. DOM-based link manipulation is a specific case where a script writes controllable data to a navigation target within the current page, such as a clickable link or a form's submission URL, letting an attacker construct a URL that modifies link targets for another user who visits it.
Bottom line: Burp Suite flags this issue through dynamic and static code analysis, and its static analysis alone can produce false positives that are not actually exploitable, so a finding without dynamic evidence still needs code and execution-path review. The recommended fix is to avoid setting link or form target URLs from untrusted data at all, or otherwise validate targets against a whitelist of permitted URLs in client-side code.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026