NowSecure static analysis: App Configuration Allows Insecure Network Connections

jnowsecure commented 9 months ago

Finding Description

The app has globally allowed insecure connections.

By default, Android prohibits the use of cleartext communications in apps targeting Android 9 or above. If your app explicitly allows cleartext connections (using the unencrypted HTTP protocol instead of HTTPS), this will increases the risk of exposing sensitive data by accident.

There are two main ways that an app can allow cleartext connections:

Android Manifest: whenever android:usesCleartextTraffic is set to true in the Android manifest file.
Network Security Config: by setting the attribute cleartextTrafficPermitted to true within the base-config element of the Network Security Config to enable cleartext traffic globally for the app or within domain-config for a more fine-grained approach, which would apply this exception only to specific domains and their subdomains.

Steps to Reproduce

The manifest file included with the app binary is analyzed, specifically the attributes android:usesCleartextTraffic and android:networkSecurityConfig. If a Network Security Config file is specified, this test also inspects that file looking for the global setting cleartextTrafficPermitted being set to true.

Business Impact

The app is configured to allow insecure network connections, which could lead to sensitive data being intercepted or modified.

Remediation Resources

Recommended Fix

No evidence table is provided for this finding, because the conditions described are the only ones that can cause the finding to appear.

Starting with Android 9 (API level 28), cleartext support is disabled by default. You need to ensure that your app is not enabling it.

Review the Android manifest (AndroidManifest.xml) at the root of your project source set:

Verify that android:usesCleartextTraffic is not present. Otherwise, remove it.
Check if android:networkSecurityConfig is present. If yes, navigate to the file indicated by it's value, (typically res/xml/network_security_config.xml) and verify that there are no occurrences of cleartextTrafficPermitted being set to true. Otherwise, set them to false or remove them.

If your app targets Android 8.1 (API level 27) or lower you must explicitly opt out of cleartext traffic.

Note: If your app needs to establish cleartext connections to some specific backends you may consider allowing cleartext only for those connections. However, this is represents a critical risk in your app and must be avoided at all costs. You should prefer to enable secure connections on that backend or replace it for another one that is secure.

Code Samples

Good Code Example (.xml)

<base-config cleartextTrafficPermitted="false">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>

Additional Guidance

Android Developer Documentation - Android Manifest https://developer.android.com/guide/topics/manifest/manifest-intro
Android Developer Documentation - <application> element https://developer.android.com/guide/topics/manifest/application-element
Android Developer Documentation - Network Security Config https://developer.android.com/training/articles/security-config

Risk and Regulatory Information

Severity: medium

CVSS: 5.3

Policy Category: Default Priority 1

CWE: 319
FISMA LOW: SC-13 CRYPTOGRAPHIC PROTECTION
FISMA MED: SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY
Risk OWASP: MSTG-NETWORK-1 (OWASP MASVS v1.5.0), MASVS-NETWORK-1 (OWASP MASVS v2.0.0)
GDPR: Risks violating Article 25, Risks violating Article 32
FFIEC: May violate D3.PC.Am.Int.7
PCI: May violate requirement 4.1
HIPAA: May violate §164.312(e)(1): Standard: Transmission security.
CCPA: Risks violating CCPA: exfiltration, theft, or disclosure of PII

Application

Platform: android
Package: com.accuweather.android
Policy: Financial Apps Policy (Version 15)

See more detail in the NowSecure Report

jnowsecure commented 6 months ago

Update: This finding has been marked as resolved by Jack Nevill. No additional action is required.

Powered by NowSecure Platform

jnowsecure commented 6 months ago

Update: This finding has been marked as no longer resolved by Jack Nevill. Additional action is required.

Powered by NowSecure Platform

jnowsecure commented 4 months ago

Update: This finding has been dismissed by Moi, Edwin with reason "risk accepted". No additional action is required.

Powered by NowSecure Platform

edwindwalker / edwinwalker