CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
How it's found
Permissive Cross-domain Security Policy with Untrusted Domains is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
If a cross-domain policy file includes domains that should not be trusted, such as when using wildcards under a high-level domain, then the application could be attacked by these untrusted domains. In many cases, the attack can be launched without the victim even being aware of it.
Consequences
- Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context: With an overly permissive policy file, an attacker may be able to bypass the web browser's same-origin policy and conduct many of the same attacks seen in Cross-Site Scripting (CWE-79). An attacker can exploit the weakness to transfer private information from the victim's machine to the attacker, manipulate or steal cookies that may include session information, create malicious requests to a web site on behalf of the victim, or execute malicious code on the end user systems. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running ActiveX controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Mitigations
- Architecture and Design/Operation: Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
- Architecture and Design/Operation: Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
- Architecture and Design/Operation: For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
How TurboPentest tests for this (white-box)
This weakness (Permissive Cross-domain Policy with Untrusted Domains) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 12 rules for it, flagging the issue directly in your source code as part of the pentest.
- CORS Any Origin With Credentials
- CORS Reflect Any Origin
- Permissive CORS Wildcard
- Permissive CORS Wildcard
- CORS Acao Wildcard Header
- CORS Wildcard Origin
- CORS Wildcard With Credentials
- CORS Reflected Origin With Credentials
- CORS Wildcard Origin
- CORS Allow All Origins
- CORS Credentials Any Origin
- CORS Wildcard With Credentials
Frequently asked questions
What is CWE-942?
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
How do you find Permissive Cross-domain Security Policy with Untrusted Domains?
Permissive Cross-domain Security Policy with Untrusted Domains is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-942?
Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context: With an overly permissive policy file, an attacker may be able to bypass the web browser's same-origin policy and conduct many of the same attacks seen in Cross-Site Scripting (CWE-79). An attacker can exploit the weakness to transfer private information from the victim's machine to the attacker, manipulate or steal cookies that may include session information, create malicious requests to a web site on behalf of the victim, or execute malicious code on the end user systems. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running ActiveX controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Does TurboPentest test for Permissive Cross-domain Security Policy with Untrusted Domains?
This weakness (Permissive Cross-domain Policy with Untrusted Domains) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 12 rules for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest