Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected
@capacitor/android @capacitor/android @capacitor/android @capacitor/android @capacitor/androidNode.js
- Обновитесь до 6.2.2
- Обновитесь до 7.6.9
- Обновитесь до 8.4.3
- Обновитесь до 8.5.1
Опубликовано Обновлено