[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Apache Cordova 3.5.1: CVE-2014-3502 update
The following text is amended from the original that was sent on August 4th. More background information on this amendment can be found at http://cordova.apache.org/announcements/2014/08/06/android-351-update.html
Android Platform Release: 04 Aug 2014
CVE-2014-3502: Cordova apps can potentially leak data to other apps via URL
The Apache Software Foundation
Cordova Android versions up to 3.5.0
Android applications built with the Cordova framework can launch other
applications through the use of anchor tags, or by redirecting the webview to
an Android intent URL. An attacker who can manipulate the HTML content of a
Cordova application can create links which open other applications and send
arbitrary data to those applications. An attacker who can run arbitrary
document location to such a URL. By using this in concert with a second,
vulnerable application, an attacker might be able to use this method to send
data from the Cordova application to the network.
The latest release of Cordova Android takes steps to block explicit Android
intent urls, so that they can no longer be used to start arbitrary applications
on the device.
Implicit intents, including URLs with schemes such as "tel", "geo", and "sms"
can still be used to open external applications by default, but this behaviour
can be overridden by plugins.
Developers who are concerned about this should rebuild their applications with
Cordova Android 3.5.1.
This issue was discovered by David Kaplan and Roee Hay of IBM Security Systems.