Zoom, CORS, and the Web

The recent major Zoom vulnerability, ironically, stemmed from web technologies rather than the app itself. This highlights the complexities of integrating web and native app components.

The issue revolves around custom protocols (like gittower:// or dropbox://) and how native apps register them to handle specific URLs. While effective in directly launching apps, they offer no user choice. To provide this choice, developers often use standard URLs instead.

Many apps achieve native app interaction from a webpage by using a localhost server on the user's machine, communicating via a URL scheme. This approach, while clever, raises concerns:

• Users may be unaware of the running localhost server.
• The ability of external websites to communicate with a localhost server feels intrusive.

However, safeguards exist, primarily CORS (Cross-Origin Resource Sharing). CORS prevents unauthorized cross-domain XHR requests, a crucial security measure. It's not a replacement for the browser's same-origin policy, but rather a mechanism to control cross-origin access. A website attempting to communicate with another website will fail unless the response includes an Access-Control-Allow-Origin header matching the requesting domain or using a wildcard (*). Importantly, this restriction doesn't apply to all resources; images, for instance, are exempt.

According to Chris Foster, a misunderstanding of CORS was central to the Zoom vulnerability. To bypass CORS restrictions on AJAX requests, Zoom allegedly employed an image-based workaround. This inadvertently created a significant vulnerability, allowing any website to trigger actions within the native client and access its responses.

Nicolas Bailly's article, "What you should know about CORS," clarifies the often-misunderstood nature of CORS: it's not a security measure itself but a way to bypass the same-origin policy, which is the primary security mechanism.

The above is the detailed content of Zoom, CORS, and the Web. For more information, please follow other related articles on the PHP Chinese website!