Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 11 Aug 2014 18:09:59 -0400
From: Marcel Kinard <>
Subject: Apache Cordova 3.5.1: CVE-2014-3502 update

The following text is amended from the original that was sent on August 4th. More background information on this amendment can be found at

Android Platform Release: 04 Aug 2014

CVE-2014-3502: Cordova apps can potentially leak data to other apps via URL

Severity: Medium

The Apache Software Foundation

Versions Affected:
Cordova Android versions up to 3.5.0

Android applications built with the Cordova framework can launch other
applications through the use of anchor tags, or by redirecting the webview to
an Android intent URL. An attacker who can manipulate the HTML content of a
Cordova application can create links which open other applications and send
arbitrary data to those applications. An attacker who can run arbitrary
JavaScript code within the context of the Cordova application can also set the
document location to such a URL. By using this in concert with a second,
vulnerable application, an attacker might be able to use this method to send
data from the Cordova application to the network.

The latest release of Cordova Android takes steps to block explicit Android
intent urls, so that they can no longer be used to start arbitrary applications
on the device.

Implicit intents, including URLs with schemes such as "tel", "geo", and "sms"
can still be used to open external applications by default, but this behaviour
can be overridden by plugins.

Upgrade path:
Developers who are concerned about this should rebuild their applications with
Cordova Android 3.5.1.

This issue was discovered by David Kaplan and Roee Hay of IBM Security Systems.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.