Description

The Reclaim app uses a WebView component to display the content of the callback webpage. It displays an address bar above the WebView. But, this address bar does not update whenever the WebView navigates to a new page.

This issue occurs in reclaim-app/src/screens/Submit.tsx:

const Submit: React.FC<Props> = (props) => {
  // ...
  return (
    // ...
    <ProviderSubheading numberOfLines={1}>{template.callbackUrl}</ProviderSubheading>

Impact

Untrusted JavaScript running on callback pages (such as in an iframe) may trigger a top frame navigation to a malicious page that disguises itself as the trusted origin. This can convince the user to enter their credentials or reveal other sensitive information to the attacker's website.

Recommendations

The Submit component should update the address bar to correctly reflect the origin of the displayed page.

Remediation