1844
This application does not check the origin of the intent, thus allowing any malicious application to
remove a user. Always check the origin of an intent, or create an allowlist of trusted applications
using the manifest.xml file.
Example 2:
These Android and iOS applications intercept URL loading within a WebView and perform special
actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to
communicate with the application:
Example Language: Java (Bad)
// Android
@Override
public boolean shouldOverrideUrlLoading(WebView view, String url){
if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){
if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){
writeDataToView(view, UserData);
return false;
}
else{
return true;
}
}
}
Example Language: Objective-C (Bad)
// iOS
-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:
(UIWebViewNavigationType)exNavigationType
{
NSURL *URL = [exRequest URL];
if ([[URL scheme] isEqualToString:@"exampleScheme"])
{
NSString *functionString = [URL resourceSpecifier];
if ([functionString hasPrefix:@"specialFunction"])
{
// Make data available back in webview.
UIWebView *webView = [self writeDataToView:[URL query]];
}
return NO;
}
return YES;
}
A call into native code can then be initiated by passing parameters within the URL:
Example Language: JavaScript (Attack)
window.location = examplescheme://method?parameter=value
Because the application does not check the source, a malicious website loaded within this
WebView has the same access to the API as a trusted site.
Observed Examples
Reference Description
CVE-2000-1218 DNS server can accept DNS updates from hosts that it did not query, leading
to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2000-1218
CVE-2005-0877 DNS server can accept DNS updates from hosts that it did not query, leading
to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2005-0877
CWE Version 4.14
CWE-941: Incorrectly Specified Destination in a Communication Channel
CWE-941: Incorrectly Specified Destination in a Communication Channel