CWE-939, Improper Authorization in Handler for Custom URL Scheme, describes a mobile app that registers a custom URL scheme but does not restrict who can invoke it.
How it happens
Mobile platforms let apps register schemes such as myapp followed by a colon and slashes. MITRE notes that on iOS this is the only method for inter-application communication, and that the implementation is left to the developer. A handler that performs dangerous actions, such as changing files, becomes reachable by any app, or by a web page that launches the link.
The observed examples: CVE-2013-5725 (details) involved a URL scheme with a replace action that needed no user prompt. CVE-2013-5726 involved follow and favorite actions that let remote attackers force a user to act.
// Risky: acts on any incoming link
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey: Any] = [:]) -> Bool {
if url.host == "replace" { replaceData(from: url) }
return true
}
What an attacker gains
MITRE says an attacker can access any functionality inadvertently exposed to the source, which can mean privilege gain, bypassing protection mechanisms and effects that vary by context.
How to find it
MITRE notes static analysis can find some instances. Start by listing each registered scheme and every action its handler supports, then ask who is allowed to call each one.
How to fix it
From the MITRE record:
- Show a confirmation prompt before any action that modifies data or touches sensitive information.
- Decide whether each action should be available to all mobile apps, or only to an allowlist of apps.
Quick check
Why is a confirmation prompt a useful control here?
Because the handler cannot tell who sent the link. A prompt puts the user in the loop before a harmful action runs.
