1567
Because the application does not check the source, a malicious website loaded within this
WebView has the same access to the API as a trusted site.
Example 3:
This application uses a WebView to display websites, and creates a Javascript interface to a Java
object to allow enhanced functionality on a trusted website:
Example Language: Java (Bad)
public class WebViewGUI extends Activity {
WebView mainWebView;
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
mainWebView = new WebView(this);
mainWebView.getSettings().setJavaScriptEnabled(true);
mainWebView.addJavascriptInterface(new JavaScriptInterface(), "userInfoObject");
mainWebView.loadUrl("file:///android_asset/www/index.html");
setContentView(mainWebView);
}
final class JavaScriptInterface {
JavaScriptInterface () {}
public String getUserInfo() {
return currentUser.Info();
}
}
}
Before Android 4.2 all methods, including inherited ones, are exposed to Javascript when using
addJavascriptInterface(). This means that a malicious website loaded within this WebView can
use reflection to acquire a reference to arbitrary Java objects. This will allow the website code to
perform any action the parent application is authorized to.
For example, if the application has permission to send text messages:
Example Language: JavaScript (Attack)
<script>
userInfoObject.getClass().forName('android.telephony.SmsManager').getMethod('getDefault',null).sendTextMessage(attackNumber,
null, attackMessage, null, null);
</script>
This malicious script can use the userInfoObject object to load the SmsManager object and send
arbitrary text messages to any recipient.
Example 4:
After Android 4.2, only methods annotated with @JavascriptInterface are available in JavaScript,
protecting usage of getClass() by default, as in this example:
Example Language: Java (Bad)
final class JavaScriptInterface {
JavaScriptInterface () { }
@JavascriptInterface
public String getUserInfo() {
return currentUser.Info();
}
}
This code is not vulnerable to the above attack, but still may expose user info to malicious pages
loaded in the WebView. Even malicious iframes loaded within a trusted page may access the
exposed interface:
CWE Version 4.14
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754: Improper Check for Unusual or Exceptional Conditions