Read Time:2 Minute, 5 Second
Description
The software uses a cross-domain policy file that includes domains that should not be trusted.
Modes of Introduction:
– Implementation
Likelihood of Exploit:
Related Weaknesses
CWE-284
CWE-183
CWE-668
Consequences
Confidentiality, Integrity, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context
An attacker may be able to bypass the web browser’s same-origin policy. An attacker can exploit the weakness to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running ActiveX controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Potential Mitigations
Phase: Architecture and Design
Effectiveness:
Description:
Avoid using wildcards in the cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
Phase: Architecture and Design, Operation
Effectiveness:
Description:
For Flash, modify crossdomain.xml to use meta-policy options such as ‘master-only’ or ‘none’ to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
Phase: Architecture and Design, Operation
Effectiveness:
Description:
For Flash, modify crossdomain.xml to use meta-policy options such as ‘master-only’ or ‘none’ to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
CVE References
- CVE-2012-2292
- Product has a Silverlight cross-domain policy that does not restrict access to another application, which allows remote attackers to bypass the Same Origin Policy.
- CVE-2014-2049
- The default Flash Cross Domain policies in a product allows remote attackers to access user files.
- CVE-2007-6243
- Chain: Adobe Flash Player does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
- CVE-2008-4822
- Chain: Adobe Flash Player and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
- CVE-2010-3636
- Chain: Adobe Flash Player does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
