Android Browser Kitkat Content Spoofing Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpcj1mI-Vi-qn7LeTLVafQQzDWMBx47NRXFUyMvyQ6Od-7JB81oAPqd3ZfYeAIGzji9913tIubptEHaqWETo7vKqmHKq54nf6LIa057UrJ7lLhHOWClnQue7rWa8uLhH0ehOx5Sj0a0s4/s1600/ANDROID.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="319" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpcj1mI-Vi-qn7LeTLVafQQzDWMBx47NRXFUyMvyQ6Od-7JB81oAPqd3ZfYeAIGzji9913tIubptEHaqWETo7vKqmHKq54nf6LIa057UrJ7lLhHOWClnQue7rWa8uLhH0ehOx5Sj0a0s4/s1600/ANDROID.png" width="320" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat.  The issue that was found is commonly referred as Content spoofing Vulnerability or dialog box spoofing vulnerability which could be used to fake an alert message on a legitimate website.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">In other words, i could display an alert box (Of my choice) on the site of my choice. Whereas in chrome, Firefox and other browser the alert box appears on correct tab. </div><div class="separator" style="clear: both; text-align: left;"></div><a name='more'></a><br /><h4>POC</h4><div class="separator" style="clear: both; text-align: left;"><a onclick="test()">CLICK</a> </div><div class="separator" style="clear: both; text-align: left;"><script> function test()</div><div class="separator" style="clear: both; text-align: left;">{ window.open('http://bing.com/') setTimeout (function(){alert("HACKED");}, 5000) } </div><div class="separator" style="clear: both; text-align: left;"></script></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Upon executing the above code, the alert box would be displayed on bing.com. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTZFvC8kZbwxBFg_Gmz7YZA4Zp5qfLznB2kpldQtZ21rzkT9HDmVRrmD5PG-tLfEXTYb-OomYVuGwzuk6Lzl3dnSavBn-7RZtC1yli7TKXWuixngdCOXqRwxZguG3XDD3yMgcwhdcRIPM/s1600/unnamed.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTZFvC8kZbwxBFg_Gmz7YZA4Zp5qfLznB2kpldQtZ21rzkT9HDmVRrmD5PG-tLfEXTYb-OomYVuGwzuk6Lzl3dnSavBn-7RZtC1yli7TKXWuixngdCOXqRwxZguG3XDD3yMgcwhdcRIPM/s1600/unnamed.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both;"></div><h4>Technical Details</h4><div class="separator" style="clear: both;">The issue resides inside of the ASOP browser, and more specifically due to the fact the webview fails to overwrite the <a href="http://developer.android.com/reference/android/webkit/WebChromeClient.html" rel="nofollow" target="_blank">WebChromeClient.onJsAlert()</a> method which is responsible for displaying the javascript alert box and this way webview is not able to switch the JsAlert() to the correct tab.</div><div class="separator" style="clear: both;"></div><h4>Future Releases</h4><div class="separator" style="clear: both;">I have recently reported another medium risk issue present in latest android stock browser, which would be released once the issue is addressed by the Google team. </div></div>

Android Browser Kitkat Content Spoofing Vulnerability

The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat.  T...

+ Read more »