Executive brief
cordova-plugin-ionic-webview is a component that provides web container functionality for mobile apps built with Apache Cordova. A path traversal vulnerability in versions before 2.2.0 allows attackers to bypass iOS sandbox restrictions and access sensitive local files on the device, potentially exposing user data, application secrets, or system configuration files.
Technical details
This is a path traversal vulnerability (CWE-22) in cordova-plugin-ionic-webview affecting versions prior to 2.2.0. The vulnerability exists because the package launches an unprotected web server on localhost:8080 without properly restricting file access, allowing the application to escape the iOS application sandbox. An attacker with network access to the device (or malicious code running on it) can craft requests to traverse the filesystem and access files outside the intended application directory. The attack vector is network-based, requires no authentication or user interaction, and has high confidentiality impact. The vulnerability is fixed in version 2.2.0 and later.
Affected products
- Ionic cordova-plugin-ionic-webview before 2.2.0
Timeline
- 2019-02-12: disclosed
- 2019: patched: Version 2.2.0 released