How android WebView can be exploited and how to secure my app from WebView vulnerability?

Question

I heard that WebView vulnerability is active in Android versions before 4.2. I read that it is fixed by Google in their newer updates from 4.2. What I want to know is a brief description of the WebView vulnerability, like, how an attacker can use this vulnerability and any solution to fix this by myself in my app if it is possible to secure my Android app from this vulnerability.

Answer 1

The primary vulnerabilties involved in the WebView component are Insecure Direct Object References, SQL Injection, and Cross-Site Scripting (XSS).

While all three are potentially huge risks, the XSS vulnerability potential can be used to gain access to shared preference files using the file:/// command or can utilize smsJSInterface.launchSMSActivity to send unwanted SMS messages from the phone, in addition to stealing credentials or providing a false front to the HTML, CSS, Javascript, or other browser-level behavior.

If you turn off the setJavaScriptEnabled as follows, adversaries will not be able to run any Javascript in order to perform XSS attacks:

myWebView.getSettings().setJavaScriptEnabled(false);

Or, if you can't do this, be sure that each context is escaped properly by using an XSS filter component such as the OWASP Java Encoder Project.

You can see what data is available to each WebView by using the sqlite3 command-line tool or a SQLite3-compatable browser to view the /app/-packagename-/db/webview.db file. Of course, any input that makes its way into the SQLite3 database or that performs a query or other string operation against it can become a potential insertion point for SQL injection -- albeit in some cases a network MITM scenario may be required.

Some examples of insecure direct object references can be found in these penetration testing tutorials against the HerdFinancial app which is a part of the OWASP GoatDroid Project:

• http://jit6ndrakumar.blogspot.com/2014/07/android-app-pentesting-part3.html
• http://jit6ndrakumar.blogspot.com/2014/07/android-app-pentesting-part4.html

Answer 2

WebView can also be exploited by malicious websites as there's no way to know if a site has been labeled as malware or phishing. And most of the time, developers don't display the URL so end-users can't even check to see if the site is what they think it is. We've just launched a Security API to address this problem https://metacert.com/api-documentation/getting-started/ would love to hear your thoughts on the API and documentation - you can use the free service with no contract.

Answer 3

In addition to the excellent answer by @atdre, I would like to point out that the webview being able to exploit the underlying app is just one side of the story. The other side is the underlying app that may try to abuse JS interface capabilities to access (& potentially exploit) the whole of the page loaded inside the webview.

I have tried explaining this in (too much) details here You may want to check it out.