1849
Phase: Architecture and Design
Strategy = Attack Surface Reduction
Avoid using wildcards in the cross-domain policy file. Any domain matching the wildcard
expression will be implicitly trusted, and can perform two-way interaction with the target server.
Phase: Architecture and Design
Phase: Operation
Strategy = Environment Hardening
For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to
reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
Phase: Architecture and Design
Phase: Operation
Strategy = Attack Surface Reduction
For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to
reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
Demonstrative Examples
Example 1:
These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other
domains to access its data:
Flash crossdomain.xml :
Example Language: XML (Bad)
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*.example.com"/>
<allow-access-from domain="*"/>
</cross-domain-policy>
Silverlight clientaccesspolicy.xml :
Example Language: XML (Bad)
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="SOAPAction">
<domain uri="*"/>
</allow-from>
<grant-to>
<resource path="/" include-subpaths="true"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
These entries are far too permissive, allowing any Flash or Silverlight application to send requests.
A malicious application hosted on any other web site will be able to send requests on behalf of any
user tricked into executing it.
Observed Examples
CWE Version 4.14
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
CWE-943: Improper Neutralization of Special Elements in Data Query Logic