Description

Detects insecure X-Permitted-Cross-Domain-Policies header configurations that could allow cross-domain access to sensitive resources. When this header is present but not set to 'none', it may enable potentially dangerous cross-domain access through crossdomain.xml or clientaccesspolicy.xml files, which could lead to unauthorized data exposure.

Detection Strategy

• Examines the HTTP response headers for presence of X-Permitted-Cross-Domain-Policies header

• Reports a vulnerability if the header is present and its value is not explicitly set to 'none' (case insensitive)

• The check applies to all HTTP responses from the web application