Kingdom: Input Validation and Representation

Input validation and representation problems ares caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others.

Link Injection: Auto Dial

Objective-C
Swift

Abstract

The identified method loads a page into a webview but does not implement any controls to prevent auto-dialing attacks when visiting malicious sites.

Explanation

Unless the contents of the page are completely under your control, the user will be able to click on links that could be used by malicious attackers to initiate automatic telephone or FaceTime calls.

As an example, your application may be showing a blog post, or tweet, that may contain links. The author of the post or tweet your user is visiting will be able to use any arbitrary links on their pages. If your users visit a malicious site and are fooled, or automatically driven to click a link, an attacker may be able to initiate automatic FaceTime or telephone calls and block the device for a few seconds to prevent the user from cancelling the call. Note that even if you control the landing page, the user may end up navigating to different and untrusted sites.

Example 1: The following snippet of code uses a webview to load a site that may contain untrusted links but it does not specify a delegate capable of validating the requests initiated in this webview:


    ...
    NSURL *webUrl = [[NSURL alloc] initWithString:@"https://some.site.com/"];
    NSURLRequest *webRequest = [[NSURLRequest alloc] initWithURL:webUrl];
    [_webView loadRequest:webRequest];
    ...

References

[1] Collin Mulliner iOS WebView auto dialer bug

[2] Apple UIWebViewDelegate

[3] Standards Mapping - Common Weakness Enumeration CWE ID 501

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001084, CCI-002754

[5] Standards Mapping - FIPS200 SI

[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-3 Security Function Isolation (P1), SI-10 Information Input Validation (P1)

[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-3 Security Function Isolation, SI-10 Information Input Validation

[9] Standards Mapping - OWASP Mobile 2014 M8 Security Decisions Via Untrusted Inputs

[10] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[11] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4, MASVS-PLATFORM-1, MASVS-PLATFORM-2

[12] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input

[13] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.1

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I

[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I

[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I

[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I

[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I

[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I

[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I

[26] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[27] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[28] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[29] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[30] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[31] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[32] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002360 CAT II, APSC-DV-002560 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002360 CAT II, APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002360 CAT II, APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[41] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.dataflow.objc.link_injection_auto_dial

Abstract

The identified method loads a page into a webview but does not implement any controls to prevent auto-dialing attacks when visiting malicious sites.

Explanation


    ...
    let webUrl : NSURL = NSURL(string: "https://some.site.com/")!
    let webRequest : NSURLRequest = NSURLRequest(URL: webUrl)
    webView.loadRequest(webRequest)
    ...