wstg-conf-08

Test ID

WSTG-CONF-08

Test Name

Test RIA Cross Domain Policy

Status

Note: This test case has been deprecated by OWASP as Flash and Silverlight technologies are no longer widely used. However, legacy applications may still use these technologies.

---

High-Level Description

Rich Internet Application (RIA) cross-domain policy files control how Flash and Silverlight applications can access resources across different domains. Misconfigured policy files can allow unauthorized cross-domain access, leading to data theft and other security issues. While these technologies are largely obsolete, legacy applications may still require this testing.

---

What to Check

Policy Files

• /crossdomain.xml (Adobe Flash)
• /clientaccesspolicy.xml (Microsoft Silverlight)
• Wildcard permissions (*)
• Overly permissive configurations
• Unnecessary cross-domain access

---

How to Test

Step 1: Retrieve Policy Files

# Check for Flash crossdomain.xml
curl -s https://target.com/crossdomain.xml

# Check for Silverlight clientaccesspolicy.xml
curl -s https://target.com/clientaccesspolicy.xml

Step 2: Analyze crossdomain.xml

<!-- VULNERABLE - Allows any domain -->
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*"/>
</cross-domain-policy>

<!-- SECURE - Specific domains only -->
<?xml version="1.0"?>
<cross-domain-policy>
    <allow-access-from domain="trusted.example.com"/>
    <allow-access-from domain="api.example.com"/>
</cross-domain-policy>

Step 3: Analyze clientaccesspolicy.xml

<!-- VULNERABLE - Allows any domain -->
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
    <cross-domain-access>
        <policy>
            <allow-from http-request-headers="*">
                <domain uri="*"/>
            </allow-from>
            <grant-to>
                <resource path="/" include-subpaths="true"/>
            </grant-to>
        </policy>
    </cross-domain-access>
</access-policy>

<!-- SECURE - Specific domains only -->
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
    <cross-domain-access>
        <policy>
            <allow-from http-request-headers="SOAPAction">
                <domain uri="https://trusted.example.com"/>
            </allow-from>
            <grant-to>
                <resource path="/api/" include-subpaths="true"/>
            </grant-to>
        </policy>
    </cross-domain-access>
</access-policy>

Step 4: Check for Vulnerable Patterns

# Check for wildcard in crossdomain.xml
curl -s https://target.com/crossdomain.xml | grep -E 'domain="\*"|domain="\*\.|secure="false"'

# Check for wildcard in clientaccesspolicy.xml
curl -s https://target.com/clientaccesspolicy.xml | grep -E 'uri="\*"|uri="http://'

---

Tools

Tool	Description	Usage
curl	Retrieve policy files	curl -s url/crossdomain.xml
Nikto	Web scanner	Includes RIA policy checks
Burp Suite	Proxy	Analyze policy files

---

Remediation Guide

1. Remove If Not Needed

If Flash/Silverlight are not used, remove policy files:

rm /var/www/html/crossdomain.xml
rm /var/www/html/clientaccesspolicy.xml

2. Restrict Access (If Needed)

<!-- crossdomain.xml - Specific domains only -->
<?xml version="1.0"?>
<cross-domain-policy>
    <site-control permitted-cross-domain-policies="master-only"/>
    <allow-access-from domain="trusted.example.com" secure="true"/>
</cross-domain-policy>

3. Modern Alternative - Use CORS

Instead of RIA policies, implement proper CORS headers for modern applications:

Access-Control-Allow-Origin: https://trusted.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type

---

Risk Assessment

CVSS Score

Wildcard Cross-Domain Policy

• Base Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

---

CWE Categories

CWE ID	Title
CWE-942	Overly Permissive Cross-domain Whitelist
CWE-346	Origin Validation Error

---

References

• OWASP Testing Guide
• For modern cross-origin testing, see: WSTG-CLNT-07: Test Cross Origin Resource Sharing (CORS)

---

Checklist

[ ] crossdomain.xml checked
[ ] clientaccesspolicy.xml checked
[ ] Wildcard permissions identified
[ ] Overly permissive configs documented
[ ] If RIA not used, recommend removal
[ ] For modern apps, test CORS instead