Overview

iOS apps can dynamically load content into a WKWebView using various URL load methods. These methods can render both remote web content and locally stored files.

The following WKWebView APIs are commonly targeted if they process untrusted input:

Remote URL Loading:

Local URL and Content Loading:

Regardless of the source, passing a URL originating from attacker-controlled input (for example through a deep link, custom URL scheme, or user-supplied data from the UI) directly to the WKWebView URL load methods can lead to vulnerabilities such as unauthorized redirection, Cross-Site Scripting (XSS), or local file disclosure.

This test checks whether the app passes attacker-controlled input to WKWebView URL load APIs without adequate URL validation.

Steps

  1. Use MASTG-TECH-0058 to extract the relevant binaries from app package.
  2. Use MASTG-TECH-0066 to look for the relevant APIs in the app binaries.

Observation

The output should contain a list of locations in the binary where WKWebView URL load APIs are called.

Evaluation

The test case fails if any call to WKWebView URL load APIs is found where the URL is derived from attacker-controlled input without proper validation.

Further Validation Required:

Inspect each reported code location using MASTG-TECH-0076:

Linkede sager

Sagslinks
is related to MASTG-BEST-0034 Validate WebView Input (iOS)