CAPEC-503 Metadata
Likelihood of Attack
Medium
Typical Severity
Medium
Overview
Summary
An adversary, through a malicious web page, accesses application specific functionality by leveraging interfaces registered through WebView's addJavascriptInterface API. Once an interface is registered to WebView through addJavascriptInterface, it becomes global and all pages loaded in the WebView can call this interface.
Prerequisites
This type of an attack requires the adversary to convince the user to load the malicious web page inside the target application. Once loaded, the malicious web page will have the same permissions as the target application and will have access to all registered interfaces. Both the permission and the interface must be in place for the functionality to be exposed.
Potential Solutions / Mitigations
To mitigate this type of an attack, an application should limit permissions to only those required and should verify the origin of all web content it loads.
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-284 | Improper Access Control |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-122 | An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.