5

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview.

This form is very straight forward vulnerable to a reflected XSS. An attack vector as simple as "><script>alert(1);</script><div is a sufficient PoC.

Now in traditional web applications I understand the impact that a potential reflected XSS (like the above) may have and that there are a dozen exploit techniques there, including BeeF etc.

However, I am unable to evaluate the impact of such a bug in the former case (Android WebView). Specifically, since the form is rendered within the web view of the app and given that the app has no open ends where other apps could interact with it through intents etc., what could be a possible way an attacker might use to exploit this reflected XSS.

Just passing on a hyperlink through some social engineering, won't really work I guess. Because, even if the potential victim opens up the link in his mobile browser, the browser would be a completely different app altogether, having no gateway to interact with our vulnerable app in question, isn't it ?

Now just for the sake of this being a security vuln, I do not want to ride on top of the dev to get it fixed(I have been a dev, so I can empathize :)). But from a security perspective, I certainly want to get it fixed :P and so I am looking out for an exploit scenario.

Any answers/pointers appreciated.

Improve this question
6
  • Well, the fact that the developer does not perform input validation should be sufficient enough to tell him to fix the problem. In order to give you a proper answer on how to exploit it, I think more information is required about the application itself. I can see where this vulnerability could have potential issues if an authentication mechanism is used where a session cookie could possibly be stolen.
    – Jeroen
    May 16, 2015 at 6:34
  • What more information can I provide to help the situation ?
    – qre0ct
    May 17, 2015 at 7:15
  • 1
    What's the application's purpose / functionality? Is there an authentication mechanism? Is there an authorization mechanism? Etc.
    – Jeroen
    May 17, 2015 at 8:27
  • Yes, the application does have a login activity. And the vulnerable page is accessible only post authentication. In fact, all the other activities are authorized to be accessed only post authentication. However, there is no ACL kind of authorization to different parts of the app. Anyone who is authenticated can pretty much access the whole app. As far as the functionality goes, the app is a cab booking app that allows users to search and book cabs.
    – qre0ct
    May 18, 2015 at 5:43
  • 1
    So with XSS available there might be a posibility to steal the session cookie (unless the cookie has the attribute httponly set) an authenticated user could steal another legitimate's user's session cookie. Another thing is that this app could be used to redirect users to a malicious website. I wouldn't mind to have a look at your APK and audit it (if you want me to of course)
    – Jeroen
    May 18, 2015 at 6:02

1 Answer 1

Reset to default
1

A lot of the comments above are irrelevant. None of that stuff really matters. In the app, did the developer create a feature where external links are automatically redirected to the app? If not, the threat is very low.

Somebody would have to decompile the app and add that feature in and redistribute it order to successfully exploit that vulnerability. I would fix it regardless but the threat is low.

Stored XSS would be a different story.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .