CWE-942 — Permissive Cross-domain Security Policy with Untrusted Domains
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
If a cross-domain policy file includes domains that should not be trusted, such as when using wildcards under a high-level domain, then the application could be attacked by these untrusted domains. In many cases, the attack can be launched without the victim even being aware of it.
Common consequences
- Confidentiality, Integrity, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context
Mitigations
Architecture and Design — Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
Architecture and Design — Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
Architecture and Design — For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
References
- CWE page: https://cwe.mitre.org/data/definitions/942.html
- CWE list: https://cwe.mitre.org/data/index.html