Insecure whitelist
Insecure whitelist
Description
The application's whitelist may be bypassed since the URL may be used as a prefix to another domain. Eg, 127.0.0.1* may be bypassed by accessing the domain 127.0.0.1.badsite.net
Recommendation
Cordova offers a powerful security model to provide developers with the tools to prevent unauthorized access and Cross-Site Scripting vulnerabilities.
Cordova whitelist manages network security access and must authorize explicitly accessible resources only.
Links
- Cordova Security Whitelist and Content Security Policy Guide
- Whitelist Guide
- Apache Cordova CVE-2015-5256
- Apache Cordova CVE-2015-1835
Standards
- OWASP_MASVS_L1:
- MSTG_PLATFORM_2
- OWASP_MASVS_L2:
- MSTG_PLATFORM_2
- PCI_STANDARDS:
- REQ_2_2
- REQ_6_2
- REQ_6_3
- REQ_7_3
- REQ_11_3