ATS Allows Arbitrary Loads In Web Content
ID |
swift.ats_allows_arbitrary_loads_in_web_content |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Information Leak |
Language |
Swift |
Tags |
ASVS50:v12.2.1, ASVS50:v12.3.1, ASVS50:v12.3.3, ASVS50:v4.4.1, ASVS50:v4.4.4, CWE:319, MASVS:MSTG-NETWORK-1, OWASP:2025:A06 |
Description
The NSAllowsArbitraryLoadsInWebContent key in Info.plist disables App
Transport Security (ATS) for content loaded inside WKWebView and the
legacy UIWebView. When set to true, embedded web views will fetch
pages and sub-resources over plain HTTP without complaint.
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoadsInWebContent</key> <!-- FLAW -->
<true/>
</dict>
Rationale
The bypass survives review at organisations that scan only the top-level
NSAllowsArbitraryLoads flag: NSAllowsArbitraryLoadsInWebContent is a
separate, narrower ATS opt-out frequently enabled for a quick test
against an HTTP page and forgotten. Attackers on the network path can
inject script into the WebView and pivot into the host app.
Remediation
Remove the key or set it to false. Migrate any HTTP pages to HTTPS;
if a single host must stay HTTP, add a narrow NSExceptionDomains entry
scoped to that domain only.
References
-
CWE-319: Cleartext Transmission of Sensitive Information.