Weak Host Validation
The class
com.insecureshop.WebViewActivity contains the following code. As per the code, the application registers a path webview and a query parameter url. The application implements a URL validation and only allows URLs that ends with insecureshopapp.com to be loaded in Webview.} else if (kotlin.text.StringsKt.equals$default(uri.getPath(), "/webview", false, 2, (java.lang.Object) null)) {
android.content.Intent intent3 = getIntent();
kotlin.jvm.internal.Intrinsics.checkExpressionValueIsNotNull(intent3, "intent");
android.net.Uri data3 = intent3.getData();
if (data3 == null) {
kotlin.jvm.internal.Intrinsics.throwNpe();
}
java.lang.String queryParameter = data3.getQueryParameter("url");
if (queryParameter == null) {
kotlin.jvm.internal.Intrinsics.throwNpe();
}
kotlin.jvm.internal.Intrinsics.checkExpressionValueIsNotNull(queryParameter, "intent.data!!.getQueryParameter(\"url\")!!");
if (kotlin.text.StringsKt.endsWith$default(queryParameter, "insecureshopapp.com", false, 2, (java.lang.Object) null)) {
android.content.Intent intent4 = getIntent();
kotlin.jvm.internal.Intrinsics.checkExpressionValueIsNotNull(intent4, "intent");
android.net.Uri data4 = intent4.getData();
if (data4 != null) {
str = data4.getQueryParameter("url");
}
data = str;
}
}
Since the application implements a weak host validation, a malicious application can bypass the host validation by loading arbitrary URL owned by attacker that ends with
insecureshopapp.com. In such a case something like attackerinsecureshopapp.com would stand valid.