CVE-2019-0219: Apache cordova-plugin-inappbrowser privilege escalation on Android

Executive brief

The cordova-plugin-inappbrowser is a tool used in mobile applications to display web pages within the app. A security flaw in older versions allows a malicious website opened inside this browser window to take control of the main application. This could lead to the theft of sensitive user data or unauthorized actions being performed by the app on the user's behalf.

Technical details

A privilege escalation vulnerability exists in cordova-plugin-inappbrowser versions prior to 3.1.0 on Android. The flaw is rooted in improper neutralization of input, specifically allowing a website running within the InAppBrowser webview to trigger arbitrary JavaScript execution in the main application's webview. This is achieved by using a specially crafted 'gap-iab:' URI. An attacker who can convince a user to visit a malicious site within the affected InAppBrowser component can gain full control over the host application's web environment. The issue is resolved in version 3.1.0.

Affected products

• Apache cordova-plugin-inappbrowser < 3.1.0

Timeline

• 2019-11-28: disclosed: Public disclosure on oss-security list
• 2020-01-14: advisory: NVD publication date
• 2020-09-04: advisory: GitHub Advisory published

References

• https://api.github.com/users/NiklasMerz
• https://github.com/NiklasMerz
• https://api.github.com/users/NiklasMerz/gists%7B/gist_id%7D
• https://api.github.com/users/NiklasMerz/repos
• https://avatars.githubusercontent.com/u/3585860?v=4
• https://api.github.com/users/NiklasMerz/events%7B/privacy%7D