what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 2 of 2

Files Date: 2015-11-21 to 2015-11-22

Apache Cordova 3.7.2 Whitelist Failure

Posted Nov 21, 2015

Authored by Muneaki Nishimura

Android applications created using Apache Cordova that use a remote server contain a vulnerability where whitelist restrictions are not properly applied. Improperly crafted URIs could be used to circumvent the whitelist, allowing for the execution of non-whitelisted Javascript. Versions 3.7.2 and below are affected.

tags | advisory, remote, javascript

advisories | CVE-2015-5256

SHA-256 | 468458d33746c0862b6ee47045cc0b4a5cc12550b39e5ec7f6aa2a3a16cc6bd8

Download | Favorite | View

Apache Cordova Android 3.6.4 BridgeSecret Weak Randomization

Posted Nov 21, 2015

Authored by Roee Hay, David Kaplan

Apache Cordova Android versions 3.6.4 and below use a bridge that allows the Native Application to communicate with the HTML and Javascript that control the user interface. To protect this bridge on Android, the framework uses a BridgeSecret to protect it from third-party hijacking. However, the BridgeSecret is not sufficiently random and can be determined in certain scenarios.

tags | advisory, javascript

advisories | CVE-2015-5257

SHA-256 | c28802b86c45a140f404d504fd86bad54b63bcda4837aba120ab9c1831ac675a

Download | Favorite | View