12

Is CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent.

I believe in theory this is possible, and mitigation is needed, but looking for examples of previous exploits not done in a "browser"

3
8

A CSRF attack can only happen when cookies (or other authentication mechanisms) are provided by the client automatically. That is, where the client has access to cookies from multiple domains (such as a web browser storing cookies for each site you visit).

However, a mobile app containing a web viewer will typically only have the cookies for its own system. The cookies will not be shared with other applications using the same web viewer control. Anything loaded from the filing system will also be isolated from each other: Android and iOS have security controls so that apps can't read other app's data. Therefore CSRF is not likely within a mobile application.

XSS could still be an issue though as anything rendered in a web page displayed by an app where JavaScript is enabled could cause JavaScript code execution if such a flaw exists, just like within a web browser.

1
  • To activate an XSS exploit, the victim would have to either (a) visit a site containing malicious code redirecting to the server used by the mobile app's web view or (b) start the mobile application's web view using a link received from elsewhere. Do mobile devices even allow using the web view as a browser of arbitrary sites?
    – eel ghEEz
    Sep 29 '17 at 16:52
0

XSS is usually an attack against a server. Unless your phone is serving Web pages to external connections this should not be a problem. If your server that is serving the pages to the phone is vulnerable then XSS is identical to a normal website - with the exception it may be harder to trick someone into following a link. Unless your application takes in data from other untrusted sources (a file, user input, cross domain messages) and displays it unescaped - see below.

CSRF relies on picking up a valid session so it would depend on the sandbox the browser component implements. I would be very surprised if this was possible unless you have poorly implemented jsonp, or window.postMessage calls or similar. (see: https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet for more ideas on this)

5
  • "XSS is usually an attack against a server" - it is not. XSS uses vulnerabilities of the server to feed its clients malicious scripts. Being able to execute javascript is all it takes for your phone to be vulnerable. Jun 10 '15 at 20:48
  • Yes, and that is usually via poor validation on the server. As I mention there are other scenarios this could occur. See last sentence of my first paragraph.
    – Andy Boura
    Jun 10 '15 at 20:50
  • Actually you are right in that the attack's impact is at the browser however the attack is usually against the validation (or lack of it) at the server. I will choose better wording when I get a moment.
    – Andy Boura
    Jun 10 '15 at 20:57
  • I didn't mean to be picky, and your answer does cover the client vulnerability. It's just this the two first phrases which struck me as bluntly wrong before I read the rest. Jun 10 '15 at 21:05
  • No worries, useful comments, appreciated.
    – Andy Boura
    Jun 10 '15 at 21:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.