CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

High

Description

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Potential Impact

How to Fix

Architecture and Design

Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.

Architecture and Design

Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.

Architecture and Design

For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-942 vulnerabilities in your codebase.

Get Security Assessment