PTKDMobile App Security
Knowledge base / PTKD-IOS-ASSOCIATED-DOMAINS-WILDCARD
low M4 MASVS-PLATFORM-1 static analysis PTKD-IOS-ASSOCIATED-DOMAINS-WILDCARD

Wildcard associated domain (universal-link hijack surface)

An associated-domains entitlement uses a wildcard applinks host (e.g. applinks:*.example.com). Overly broad universal-link claims widen the deep-link attack surface and can enable link hijacking if any subdomain is attacker-controlled.

How it's exploited

An associated-domains entitlement claims a wildcard applinks host such as applinks:*.example.com. Every subdomain then feeds universal links into the app, so an attacker who controls or registers any subdomain can drive deep-link handlers that were trusted as first-party.

Why it matters

A wider deep-link attack surface: link hijacking and unexpected in-app navigation from hosts you do not actually control.

How to fix it

  1. Scope associated domains to explicit hosts instead of a wildcard.
  2. Validate every parameter a universal-link handler receives as untrusted input.

References