4 ms·
>It was recently discovered that applications do not even need to have a Javascript Interface in their code to be vulnerable to this attack. This is because a J
by stusmall 13y ago
>It was recently discovered that applications do not even need to have a Javascript Interface in their code to be vulnerable to this attack. This is because a Javascript Interface is implemented core webview code in Android versions before 4.2. Meaning that every single application that loads a webview over cleartext is vulnerable to this attack.
Maybe its because I haven't properly had coffee yet or because I've never used WebView in android but I'm having trouble parsing this. From the small code snippet they provided it shows them enabling javascript and adding an interface. Is this just a general comment for other apps that are working on HTTP or broken HTTPS or does it relate to this exploit?
- dmayer 13y agoThere is a CVE (CVE-2012-6636) [1,2] related to the general issue they are mentioning. Basically one could use reflection to call any public function on any class in the app. Since Android 4.2 one now needs to add the @JavascriptInterface decorator to explicitly expose methods. At least this is my current understanding of this. If the app then uses HTTP or HTTPS without certificate validation, it is easily possible to inject JavaScrpipt code even when no Cross-Site Scripting vulnerability exists in the app. [1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6636 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-66... [2] https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/ https://labs.mwrinfosecurity.com/advisories/2013/09/24/webvi...
- stusmall 13y agoThank you very much for the details and CVE link.