The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
Mobile platforms and other architectures allow the use of custom URL schemes to facilitate communication between applications. In the case of iOS, this is the only method to do inter-application communication. The implementation is at the developer's discretion which may open security flaws in the application. An example could be potentially dangerous functionality such as modifying files through a custom URL scheme.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2013-5725
URL scheme has action replace which requires no user prompt and allows remote attackers to perform undesired actions.
CVE: CVE-2013-5726
URL scheme has action follow and favorite which allows remote attackers to force user to perform undesired actions.
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Intro: This iOS application uses a custom URL scheme. The replaceFileText action in the URL scheme allows an external application to interface with the file incomingMessage.txt and replace the contents with the text field of the query string.
Body: External Application
NSString *stringURL = @"appscheme://replaceFileText?file=incomingMessage.txt&text=hello"; NSURL *url = [NSURL URLWithString:stringURL]; [[UIApplication sharedApplication] openURL:url];Intro: These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:
Body: A call into native code can then be initiated by passing parameters within the URL:
// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }