oss-security - RE: [4-3801000010480] [Update 2/20/16 CVE-2015-5256] Apache Cordova vulnerable to improper application of whitelist restrictions on Android

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 23 Feb 2016 23:57:13 +0000
From: security@...roid.com
To: Carlos Santana <csantana23@...il.com>
Cc: bugtraq@...urityfocus.com, oss-security@...ts.openwall.com, 
	"private@...dova.apache.org" <private@...dova.apache.org>, ASF Security Team <security@...che.org>
Subject: RE: [4-3801000010480] [Update 2/20/16 CVE-2015-5256] Apache Cordova
 vulnerable to improper application of whitelist restrictions on Android

Hi,

Our engineering team reviewed this issue and realized this was reported to
us back in Sept 2015 by JP Cert.

Thank you,
Quan

On 02/22/16 15:54:11 security@...roid.com wrote:

Hi
Thank you for the notification.
We will assign this to our dev team to review.
It will be tracked as AndroidID-27299922.

Thanks,
Quan

On 02/21/16 11:56:58 csantana23@...il.com wrote:

*Updated 02/20/2016*

Apache Cordova has re-visited CVE-2015-5256 "Apache Cordova vulnerable to
improper application of whitelist restrictions on Android”. Upon further
investigation we found that the vulnerability is more limited than was
previously understood.
We are lowering the severity to Low, and updating the description, affected
versions, and upgrade path.

The updated text of the CVE is included below:

Apache Cordova PMC
--------------------------
private@...dova.apache.org

____

*Updated 02/20/2016*

CVE-2015-5256: Apache Cordova vulnerable to improper application of
whitelist restrictions on Android

Severity: Low

Versions Affected:
Cordova Android with whitelist functionality

Description:

Android applications created using Apache Cordova that use a remote server
contain a vulnerability where whitelist restrictions for urls using
protocols http and https are not properly applied.  Whitelist cannot block
network redirects from a whitelisted remote website to a non-whitelisted
website.

Upgrade path:

There is no specific software patch for this vulnerability. Developers that
are concerned about this should make sure to only whitelist trusted
websites, and make sure that whitelisted websites don’t redirect to a
malicious website.
Developers using should also use SSL, as well as Content Security
Policy(CSP) to further mitigate this issue. It’s always recommended for
developers to upgrade to the latest version of Cordova Android.

Credit: Muneaki Nishimura of Sony Digital Network Applications, Inc

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.