Insecure whitelist
Insecure whitelist
Description
The application's whitelist may be bypassed since the URL may be used as a prefix to another domain. Eg, 127.0.0.1* may be bypassed by accessing the domain 127.0.0.1.badsite.net
Recommendation
Cordova offers a powerful security model to provide developers with the tools to prevent unauthorized access and Cross-Site Scripting vulnerabilities.
Cordova whitelist manages network security access and must authorize explicitly accessible resources only.
<!-- Allow access to a specific domain -->
<allow-navigation href="http://example.com/*" />
Links
- Cordova Security Whitelist and Content Security Policy Guide
- Whitelist Guide
- Apache Cordova CVE-2015-5256
- Apache Cordova CVE-2015-1835
Standards
- OWASP_MASVS_L1:
- MSTG_PLATFORM_2
- OWASP_MASVS_L2:
- MSTG_PLATFORM_2
- PCI_STANDARDS:
- REQ_2_2
- REQ_6_2
- REQ_6_3
- REQ_7_3
- REQ_11_3
- OWASP_MASVS_v2_1:
- MASVS_CODE_4
- SOC2_CONTROLS:
- CC_2_1
- CC_4_1
- CC_7_1
- CC_7_2
- CC_7_4
- CC_7_5