{"id": "SECURITYVULNS:DOC:30280", "bulletinFamily": "software", "title": "Security Vulnerabilities in Apache Cordova / PhoneGap", "description": "\r\n\r\nThe following email was sent to Apache Cordova/PhoneGap on 12/13/2013, and again on 1/17/2014. \r\nAs there has been no response, we are re-posting it here to alert the general public \r\nof the inherent vulnerabilities in Apache Cordova/PhoneGap.\r\n\r\n##############################################################################################\r\nDear PhoneGap contributors,\r\n\r\n\r\nPhoneGap\u2019s domain whitelisting for accessing native resources is\r\nbroken and can be bypassed. These vulnerabilities can be exploited by\r\nany third-party domain loaded inside an iframe (e.g., malicious ad\r\nscripts). Below, we give a brief summary of the vulnerabilities. You\r\ncan find more details in the paper <http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf>.\r\n\r\n\r\n1. Domain whitelisting on Android (before API 11) and Windows Phone 7\r\nand 8 relies on the URL interception call that does not intercept\r\niframe and XMLHttpRequest URLs. Consequently, it does not restrict\r\nwhich domains can be loaded in iframes. Any script inside an iframe\r\ncan directly use PhoneGap\u2019s internal JavaScript interfaces to the Java\r\nobjects and access native resources: for example, by calling execute =\r\ncordova.require('cordova/exec'); var opts = cordova.require\r\n('cordova/plugin/ ContactFindOptions' ); and directly operating on\r\nthese objects.\r\n\r\n\r\n2. A malicious script running in an iframe can dynamically choose any\r\nof PhoneGap\u2019s vulnerable bridge mechanisms at runtime (e.g.\r\naddJavascriptInterface or loadUrl on Android) and use it to bypass the\r\ndomain whitelist. We call this the chosen-bridge attack.\r\n\r\n\r\n3. PhoneGap\u2019s whitelisting check on Android is incorrect - it misses\r\nan anchor at the end of the regular expression:\r\nthis.whiteList.add(Pattern.compile("\u20achttps?://(.*\\.)?" + origin));\r\n\r\nFor example, if foo.com is whitelisted, foo.com.evil.com will pass the check.\r\n\r\n4. PhoneGap\u2019s domain whitelisting on Android (API 11 or highler) and\r\niOS does not adhere to the same-origin policy. Third-party scripts\r\nincluded using <script> tags are blocked unless their source domain is\r\nwhitelisted, even though these scripts execute in the origin of the\r\nhosting page, not their source origin.\r\n\r\n\r\n5. Instead of just blocking access to bridges from non-whitelisted\r\ndomains, PhoneGap completely blocks these domains from being loaded in\r\nthe browser. This prevents ad-supported apps from displaying\r\nthird-party ads and destroys the look-and-feel of many Web pages.\r\n\r\n\r\nWe have a proof-of-concept implementation (a 400-line patch for\r\nPhoneGap 2.9.0 on Android) called NoFrak\r\n[https://github.com/georgiev-martin/NoFrak] which fixes these\r\nvulnerabilities. NoFrak does not allow Web content from\r\nnon-whitelisted domains to access native resources but still displays\r\nit correctly in the browser. If you are interested in discussing how\r\nto merge NoFrak or some parts of NoFrak to PhoneGap\u2019s main branch,\r\nplease let us know.\r\n\r\n\r\nThanks,\r\n\r\nMartin, Suman, and Vitaly\r\n\r\n##############################################################################################\r\n", "published": "2014-02-03T00:00:00", "modified": "2014-02-03T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30280", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:50", "edition": 1, "viewCount": 7, "enchantments": {"score": {"value": 1.8, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13550"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13550"]}]}, "exploitation": null, "vulnersScore": 1.8}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645433257}}

{}