The product uses a web-client protection
mechanism such as a Content Security Policy (CSP) or
cross-domain policy file, but the policy includes untrusted
domains with which the web client is allowed to
communicate.
If a cross-domain policy file includes domains that should not be trusted, such as when using wildcards under a high-level domain, then the application could be attacked by these untrusted domains. In many cases, the attack can be launched without the victim even being aware of it.
In HTTP/HTTPS, policies such as the Same Origin Policy prevent web clients from loading resources from (or making requests to) domains that did not match the web site's own domain, e.g., Javascript or other code hosted on third-party servers. These policies are strictly enforced by browsers and other products. However, these restrictions can be reduced using mechanisms that specify other domains that are allowed to be contacted from the original site, such as Content Security Policy (CSP) or cross-domain policy files (e.g., "crossdomain.xml" in Adobe Flash or Reader, "clientaccesspolicy.xml" in Silverlight, etc.). These mechanisms define a list of domains from which a client is allowed to make cross-domain requests. When making a cross-domain request, the client will first look for the policy file on the target server. If it is found, and the domain hosting the application is explicitly allowed to make requests, the request is made.
