JVN#73346595: applican vulnerable to URL whitelist bypass

applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican provides a whitelisting function (whitelist.xml) to limit the URLs that applications can access. However, if the application is launched using the URL-scheme, the access restriction is bypassed and URLs that are not whitelisted can be accessed. If an API of applican framework is specified in the URL, the API will be called in the context of the URL.

Impact

Android apps built using applican may allow an applican API to be executed if that API has been granted permission in the android manifest.
iOS apps built using applican may allow an arbitrary API to be executed.

Solution

Update applican and rebuild the application
Update to the latest version of applican and rebuild the application according to the information provided by the developer.

Products Affected

• Applications built using applican for Android versions 1.12.2 and earlier
• Applications built using applican for iOS versions 1.12.2 and earlier
  [Added on October 14, 2015]
  Note that applican for iOS ver. 1.12.2 did not address the vulnerability completely. Newer versions have been released.