Versions of cordova-plugin-ionic-webview prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.

Recommendation

Upgrade to version 2.2.0

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-16202
• GHSA-xwjh-cp99-cj8q
• https://www.npmjs.com/advisories/746
• https://github.com/ionic-team/cordova-plugin-ionic-webview
• https://jvn.jp/en/jp/JVN69812763/index.html
• http://jvn.jp/en/jp/JVN60497148/index.html