Update CWE mapping on MASWE elements of MASVS-PLATFORM #3149

truerick · 2025-02-13T13:50:06Z

Update all CWE IDs on MASWE elements of MASVS-PLATFORM

This PR is related to issue #2858 .

cpholguera · 2025-04-02T18:07:12Z

weaknesses/MASVS-PLATFORM/MASWE-0058.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-3]
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2, MASVS-CODE-4]
+  cwe: [939, 917]


Please explain how https://cwe.mitre.org/data/definitions/917.html relates to this weakness.

Deep Link parameters offers a wide range of possibilities. A malformed URI or parameter value, if not sanitized, may trigger an injection in different points of the application.

So, if CWE 939 prevents the exploit of the URI checking the source, CWE 917 prevents the exploit of the URI checking the content.

cpholguera · 2025-04-02T18:12:15Z

weaknesses/MASVS-PLATFORM/MASWE-0059.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [287]


This CWE is DISCOURAGED and seems unrelated. It relates to "user authentication".

The "discouraged" mapping is appliable if you have to map a specific vulnerability to a weakness. Despite we tried to avoid mapping on high-level abstraction CWEs, depending on available content the "discouraged" CWEs may have been used to define the weaknesses.

If CWE-287 unfit the intended weakness, other possibilities may be:

CWE-668: Exposure of Resource to Wrong Sphere

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

If both still don't fit the wekaness, we suggest to leave it blank and define CWEs once the weakness has been written to better understand the scope.

cpholguera · 2025-04-02T18:15:10Z

weaknesses/MASVS-PLATFORM/MASWE-0060.md

@@ -6,6 +6,7 @@ platform: [ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [285, 358]


285 is DISCOURAGED and I'm not sure how it relates to this weakness.

I'm also not sure how this relates to 385, please elaborate.

CWE-285 is intended as exposing UIActivity information to untrusted apps or actors. Taking your suggestion to try be more focuses on the meaning, this may be changed to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Suggested CWE is 358 (Improperly Implemented Security Check for Standard), related to possible bad activityViewController implemented in the UIActivity, not 385 (Covert Timing Channel) which is actually out of scope.

weaknesses/MASVS-PLATFORM/MASWE-0061.md

weaknesses/MASVS-PLATFORM/MASWE-0063.md

cpholguera · 2025-04-02T18:28:05Z

weaknesses/MASVS-PLATFORM/MASWE-0068.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-7]
  masvs-v2: [MASVS-PLATFORM-2, MASVS-STORAGE-2]
+  cwe: [749, 94]


How does 94 relate? Please elaborate.

CWE-94: Improper Control of Generation of Code ('Code Injection') is stricly related to Android FAQ linked in the MASWE item draft.

A bad Intent may allow attackers to inject code in the webview interface, so as a JS bridge.

cpholguera · 2025-04-02T18:30:01Z

weaknesses/MASVS-PLATFORM/MASWE-0069.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-6]
  masvs-v2: [MASVS-PLATFORM-2, MASVS-STORAGE-2]
+  cwe: [200, 22]


22 (“Path Traversal”) deals with attackers manipulating file path inputs (like using “../”) to access files outside an intended directory. In contrast, the issue with WebViews allowing access to local resources via settings like setAllowFileAccessFromFileURLs isn’t about traversing directories, it’s about insecurely granting file access in the first place. Therefore, CWE‑22 isn’t the best match for this weakness I'd say.

Maybe we don't have a weakness for 22 yet, is it in CODE?

CWE-22 is suggested in CODE, in MASWE-0082: Unsafe Handling of Data From Local Storage.

From the CWE-22 page: "Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files."
I think that trying to access /data/[...] folder because the method is not correctly initialized may cause an actual path traversal attack.

See also https://developer.android.com/privacy-and-security/risks/webview-unsafe-file-inclusion?hl=en

cpholguera · 2025-04-02T18:34:30Z

weaknesses/MASVS-PLATFORM/MASWE-0073.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-2, MASVS-CODE-4]
+  cwe: [79, 200]


200 is DISCOURAGED.

79 is XSS which can enable a successful attack here but it's a separate weakness: MASWE-0072.

CWE may be changed to CWE-669: Incorrect Resource Transfer Between Spheres

Since the usage of WebViewAssetLoader avoid using unsafe schemes that transfer content between app resources and a webview, it may fit.

I also noticed we should change platform of the MASWE only to Android

iOS removed from platform list.

cpholguera · 2025-04-02T18:44:32Z

weaknesses/MASVS-PLATFORM/MASWE-0070.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-2, MASVS-CODE-4]
+  cwe: [79, 20, 829]


20 is DISCOURAGED.

79 is about the injection and execution of malicious scripts in a web page, while 829 is about the risks associated with incorporating untrusted code or functionality, which can sometimes lead to various security problems but is not, by itself, defined as cross-site scripting.

829 seems like a good fit.

Maybe also https://cwe.mitre.org/data/definitions/830.html

CWE-830: Inclusion of Web Functionality from an Untrusted Source is a variant of CWE-829: Inclusion of Functionality from Untrusted Control Sphere; it can be a substitute but I wouldn't put both of them.

In the Example 1 of CWE-830 it says:
This webpage is now only as secure as the external domain it is including functionality from. If an attacker compromised the external domain and could add malicious scripts to the weatherwidget.js file, the attacker would have complete control, as seen in any XSS weakness (CWE-79).

I think then MASWE-0070 may lead in the same way to weakness CWE-79 and it should be listed.

Ok removing CWE-20 since better fitting option are available.

cpholguera · 2025-04-02T18:59:37Z

weaknesses/MASVS-PLATFORM/MASWE-0066.md

@@ -6,6 +6,7 @@ platform: [android]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [927]


Maybe also https://cwe.mitre.org/data/definitions/940.html

Due to unverified nature of Implicit Intent, there may be no actual solution to "CWE-940: Improper Verification of Source of a Communication Channel".

In other words, the design of the component don't allow to verify the source and implement a verification of that.

Add CWE-926 to integrate not only Improper Verification of Broadcast Receiver, but also Improper Export of Android Application Components Co-authored-by: Carlos Holguera <[email protected]>

Removed CWE-276 after feedback received on bad application of the weakness.

Removed discouraged CWE

Removed iOS from platform list since the MASWE is related specifically to Android elements.

truerick

Every comment has been discussed or answered.

truerick · 2025-04-08T06:50:56Z

weaknesses/MASVS-PLATFORM/MASWE-0058.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-3]
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2, MASVS-CODE-4]
+  cwe: [939, 917]


Deep Link parameters offers a wide range of possibilities. A malformed URI or parameter value, if not sanitized, may trigger an injection in different points of the application.

So, if CWE 939 prevents the exploit of the URI checking the source, CWE 917 prevents the exploit of the URI checking the content.

truerick · 2025-04-08T07:11:10Z

weaknesses/MASVS-PLATFORM/MASWE-0059.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [287]


The "discouraged" mapping is appliable if you have to map a specific vulnerability to a weakness. Despite we tried to avoid mapping on high-level abstraction CWEs, depending on available content the "discouraged" CWEs may have been used to define the weaknesses.

If CWE-287 unfit the intended weakness, other possibilities may be:

CWE-668: Exposure of Resource to Wrong Sphere

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

If both still don't fit the wekaness, we suggest to leave it blank and define CWEs once the weakness has been written to better understand the scope.

truerick · 2025-04-08T07:40:11Z

weaknesses/MASVS-PLATFORM/MASWE-0060.md

@@ -6,6 +6,7 @@ platform: [ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [285, 358]


CWE-285 is intended as exposing UIActivity information to untrusted apps or actors. Taking your suggestion to try be more focuses on the meaning, this may be changed to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Suggested CWE is 358 (Improperly Implemented Security Check for Standard), related to possible bad activityViewController implemented in the UIActivity, not 385 (Covert Timing Channel) which is actually out of scope.

truerick · 2025-04-08T07:57:20Z

weaknesses/MASVS-PLATFORM/MASWE-0066.md

@@ -6,6 +6,7 @@ platform: [android]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-1, MASVS-STORAGE-2]
+  cwe: [927]


Due to unverified nature of Implicit Intent, there may be no actual solution to "CWE-940: Improper Verification of Source of a Communication Channel".

In other words, the design of the component don't allow to verify the source and implement a verification of that.

truerick · 2025-04-08T14:47:54Z

weaknesses/MASVS-PLATFORM/MASWE-0073.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-2, MASVS-CODE-4]
+  cwe: [79, 200]


CWE may be changed to CWE-669: Incorrect Resource Transfer Between Spheres

Since the usage of WebViewAssetLoader avoid using unsafe schemes that transfer content between app resources and a webview, it may fit.

I also noticed we should change platform of the MASWE only to Android

weaknesses/MASVS-PLATFORM/MASWE-0061.md

truerick · 2025-04-29T06:53:31Z

weaknesses/MASVS-PLATFORM/MASWE-0068.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-7]
  masvs-v2: [MASVS-PLATFORM-2, MASVS-STORAGE-2]
+  cwe: [749, 94]


CWE-94: Improper Control of Generation of Code ('Code Injection') is stricly related to Android FAQ linked in the MASWE item draft.

A bad Intent may allow attackers to inject code in the webview interface, so as a JS bridge.

truerick · 2025-04-29T07:10:56Z

weaknesses/MASVS-PLATFORM/MASWE-0069.md

@@ -7,6 +7,7 @@ profiles: [L1, L2]
 mappings:
  masvs-v1: [MSTG-PLATFORM-6]
  masvs-v2: [MASVS-PLATFORM-2, MASVS-STORAGE-2]
+  cwe: [200, 22]


CWE-22 is suggested in CODE, in MASWE-0082: Unsafe Handling of Data From Local Storage.

From the CWE-22 page: "Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files."
I think that trying to access /data/[...] folder because the method is not correctly initialized may cause an actual path traversal attack.

See also https://developer.android.com/privacy-and-security/risks/webview-unsafe-file-inclusion?hl=en

truerick · 2025-04-29T11:04:19Z

weaknesses/MASVS-PLATFORM/MASWE-0070.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L1, L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-2, MASVS-CODE-4]
+  cwe: [79, 20, 829]


CWE-830: Inclusion of Web Functionality from an Untrusted Source is a variant of CWE-829: Inclusion of Functionality from Untrusted Control Sphere; it can be a substitute but I wouldn't put both of them.

In the Example 1 of CWE-830 it says:
This webpage is now only as secure as the external domain it is including functionality from. If an attacker compromised the external domain and could add malicious scripts to the weatherwidget.js file, the attacker would have complete control, as seen in any XSS weakness (CWE-79).

I think then MASWE-0070 may lead in the same way to weakness CWE-79 and it should be listed.

Ok removing CWE-20 since better fitting option are available.

truerick · 2025-04-29T11:06:53Z

weaknesses/MASVS-PLATFORM/MASWE-0073.md

@@ -6,6 +6,7 @@ platform: [android, ios]
 profiles: [L2]
 mappings:
  masvs-v2: [MASVS-PLATFORM-2, MASVS-CODE-4]
+  cwe: [79, 200]


iOS removed from platform list.

Update CWE mapping on MASWE elements of MASVS-PLATFORM

5d3b4d7

cpholguera requested changes Apr 3, 2025

View reviewed changes

truerick and others added 4 commits April 8, 2025 09:16

Update weaknesses/MASVS-PLATFORM/MASWE-0063.md

826a76d

Add CWE-926 to integrate not only Improper Verification of Broadcast Receiver, but also Improper Export of Android Application Components Co-authored-by: Carlos Holguera <[email protected]>

Update MASWE-0061.md

9dcfc27

Removed CWE-276 after feedback received on bad application of the weakness.

Update MASWE-0070.md

e63c6e5

Removed discouraged CWE

Update MASWE-0073.md

1a0a799

Removed iOS from platform list since the MASWE is related specifically to Android elements.

truerick commented Apr 29, 2025

View reviewed changes

Merge branch 'master' into MASWE-PLATFORM

cd2de1d

Uh oh!

Update CWE mapping on MASWE elements of MASVS-PLATFORM #3149

Are you sure you want to change the base?

Update CWE mapping on MASWE elements of MASVS-PLATFORM #3149

Uh oh!

Conversation

truerick commented Feb 13, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

truerick left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!