Port MASTG test 0019 (by @guardsquare) #3030

titze · 2024-11-04T18:49:39Z

Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that:

Your contribution is written in the 2nd person (e.g. you)
Your contribution is written in an active present form for as much as possible.
You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
Your contribution has proper formatted markdown and/or code
Any references to website have been formatted as [TEXT](URL “NAME”)
You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #2959.

Adds two new draft tests:

Using low-level APIs (e.g. Socket) to set up a custom HTTP connection.
Cleartext traffic is allowed for cross-platform frameworks

cpholguera · 2024-11-05T11:12:14Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

should we add a separate test for..?

Using low-level APIs (e.g. Socket) to set up a custom HTTP connection.

This could also be a test for https://mas.owasp.org/MASWE/MASVS-NETWORK/MASWE-0049/ maybe we need to make weakness: a list.

Good point, I added a draft test for this.

cpholguera · 2024-11-05T11:15:00Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

+platform: android
+id: MASTG-TEST-0x19-2
+type: [static]
+weakness: MASWE-0050


Wouldn't https://mas.owasp.org/MASWE/MASVS-NETWORK/MASWE-0052/ be a better fit?

cpholguera · 2024-11-05T11:47:51Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

+1. Reverse engineer the app (@MASTG-TECH-0017).
+2. Run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `SSLSocket`.
+3. Verify each usage performans manual hostname verification correctly.


After changing the above, we should update the steps and be more specific. We can tell them to search for uses of SSLSocket that are not using HostnameVerifier, or that are using it but potentially incorrectly (as indicated above).

Examples (not for linking here, but maybe to use later for demos):

https://semgrep.dev/r?q=problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification

https://semgrep.dev/playground/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier?editorMode=advanced

cpholguera · 2024-11-05T11:55:30Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+Since Android 9 (API level 28) cleartext HTTP traffic is blocked by default (thanks to the [default Network Security Configuration](../../../Document/0x05g-Testing-Network-Communication.md#default-configurations)) but there are multiple ways in which an application can still send it:
+
+- Setting the [`android:usesCleartextTraffic`](https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic "Android documentation - usesCleartextTraffic flag") attribute of the `<application>` tag in the AndroidManifest.xml file. Note that this flag is ignored in case the Network Security Configuration is configured.
+- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.


Suggested change

- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

- Configuring the [Network Security Configuration to enable cleartext traffic](https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted) by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

cpholguera · 2024-11-05T12:00:25Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+
+1. Reverse engineer the app (@MASTG-TECH-0017).
+2. Verify `usesCleartextTraffic` is not set to `true` in the AndroidManifest.xml
+3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.


Suggested change

3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.

3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure that `cleartextTrafficPermitted` is not set to `true`

- globally in the `<base-config>` element.

- or for specific domains in their `<domain-config>` elements.

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

cpholguera · 2024-11-05T12:27:16Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+
+## Observation
+
+The output contains a list of domains for which cleartext traffic is enabled.


More accurate like this I think.

Suggested change

The output contains a list of domains for which cleartext traffic is enabled.

The output contains a list of configurations allowing for cleartext traffic.

cpholguera · 2024-11-05T12:28:58Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-4.md

+weakness: MASWE-0050
+---
+
+## Overview
+
+Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.
+
+## Steps
+
+## Observation
+
+## Evaluation


We can do this as long as there's a new Issue. Please mention the issue in the PR description.

Suggested change

weakness: MASWE-0050

---

## Overview

Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.

## Steps

## Observation

## Evaluation

weakness: MASWE-0050

status: draft

note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.

---

cpholguera · 2024-11-05T12:35:10Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-5.md

+
+## Overview
+
+Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted.


Rephrase to highlight more why we're doing this test, what's the value/benefit. For example, this are REAL cleartext connections not just potential ones (as it is the case if we just retrieve the hardcoded URLs).

Limitations:

thanks to doing this we can know what domains are contacted in cleartext but we don't know which location in the code is producing this traffic, right? (we can add a note in the Evaluation)

this depends on how much of the app you can exercise so you cannot expect full coverage

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-5.md

titze added 2 commits November 4, 2024 18:48

Port MASTG test 0019

d3cb11b

Fix markdown

1f8be5d

cpholguera added the MASTG Refactor label Nov 5, 2024

cpholguera requested changes Nov 5, 2024

View reviewed changes

titze added 2 commits November 5, 2024 17:50

Review feedback

355ea51

Add Frida to trace traffic

4127f2c

titze requested a review from cpholguera November 5, 2024 18:14

cpholguera added the changes-done label Nov 26, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port MASTG test 0019 (by @guardsquare) #3030

Port MASTG test 0019 (by @guardsquare) #3030

titze commented Nov 4, 2024 •

edited

Loading

cpholguera Nov 5, 2024

titze Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

cpholguera Nov 5, 2024

	- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.
	- Configuring the [Network Security Configuration to enable cleartext traffic](https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted) by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

-. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.
+. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure that `cleartextTrafficPermitted` is not set to `true`
+  - globally in the `<base-config>` element.
+  - or for specific domains in their `<domain-config>` elements.


		## Observation

		The output contains a list of domains for which cleartext traffic is enabled.

	The output contains a list of domains for which cleartext traffic is enabled.
	The output contains a list of configurations allowing for cleartext traffic.


		## Overview

		Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted.

Port MASTG test 0019 (by @guardsquare) #3030

Are you sure you want to change the base?

Port MASTG test 0019 (by @guardsquare) #3030

Conversation

titze commented Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

titze commented Nov 4, 2024 •

edited

Loading