Cross-Site Flashing

The program uses unvalidated user input to load a SWF file, which can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.

Flash APIs provide an interface for loading remote SWF files into the existing execution environment. Even though the cross-domain policy only allows to load SWF files from a list of trusted domains, more often than not the defined cross-domain policy is overly permissive. Allowing untrusted user input to define which SWF files to load can lead to arbitrary content being referenced and possibly executed by the targeted application, resulting in a cross-site flashing attack.

Cross-site flashing vulnerabilities occur when:

1. Data enters an application from an untrusted source.

2. The data is used to load a remote SWF file.
Example 1: The following code uses the value of one of the parameters to the loaded SWF file as the URL to load a remote SWF file from.

   ...
   var params:Object = LoaderInfo(this.root.loaderInfo).parameters;
   var url:String = String(params["url"]);
   var ldr:Loader = new Loader();
   var urlReq:URLRequest = new URLRequest(url);
   ldr.load(urlReq);
   ...