Description

The Reclaim app WebView ignores the content-disposition HTTP header on responses. Many websites serve potentially untrusted files using the content-disposition: attachment header to trigger a download rather than rendering the content in the browser. By ignoring this header, the Reclaim WebView may be vulnerable to cross-site scripting attacks on some websites.

Impact

An attacker can compromise the integrity and confidentiality of user data on any website that serves untrusted file downloads with the content-disposition: attachment header.

Recommendations

The Reclaim WebView should fail to navigate to any URL that responds with the content-disposition: attachment header.

Remediation

CreatorOS Inc provided the following response:

Since the severity of the issue is low and due to some limitations, Reclaim Protocol will leave this fix for future work.