Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 #2919

cpholguera · 2024-10-26T09:20:31Z

This PR
closes #2686
closes #2688
closes #2689
closes #2690
closes #2691
closes #2692

…swe-0050

TheDauntless · 2024-11-07T11:35:05Z

weaknesses/MASVS-NETWORK/MASWE-0047.md

@@ -22,3 +22,31 @@ status: draft

 ---

+## Overview
+
+Certificate pinning is a security technique used to ensure that an app only trusts specific certificates or public keys when establishing secure connections. Insecure identity pinning occurs when the implementation of certificate or public key pinning is flawed or improperly configured. This weakness can leave the app vulnerable to Man-in-the-Middle (MITM) attacks and other security threats. Common issues include outdated pins, improper validation, accepting all certificates, or using insecure methods for dynamic pinning.


Should we rename weakness to use Certificate pinning? If not, this sentence should start with Identity pinning and quickly explain that it's also called certificate pinning or TLS pinning. This should be done in both cases even, to make sure all names are mentioned at the start.

Feels weird to have 'accepting all certificates' in here. We could go for 'insecure fallback' or something, or 'insecure default', but 'accepting all certificates' seems like the opposite of identity pinning and should be a separate weakness ("Not validating TLS certificate" or something)

weaknesses/MASVS-NETWORK/MASWE-0047.md

weaknesses/MASVS-NETWORK/MASWE-0048.md

TheDauntless

Some suggestions :)

TheDauntless · 2024-11-07T11:45:43Z

weaknesses/MASVS-NETWORK/MASWE-0049.md

@@ -21,3 +21,29 @@ status: draft

 ---

+## Overview
+
+Applications that do not utilize platform-provided networking APIs or well-established security libraries are susceptible to security vulnerabilities. When developers implement custom networking code or "roll their own" security mechanisms, they risk introducing flaws due to a lack of deep expertise in cryptography and network security. Platform-provided APIs and libraries, such as `NSURLSession` on iOS or `HttpsURLConnection` on Android, are designed and maintained by experts, incorporating security best practices and regular updates to address new threats and vulnerabilities.


Weakness title should be 'Proven' instead of 'Proved'. While both are correct past participles, 'proven' is typically used for the adjective case.

TheDauntless · 2024-11-07T11:48:26Z

weaknesses/MASVS-NETWORK/MASWE-0050.md

 ---

+## Overview
+
+When data is sent in cleartext—without encryption—it becomes accessible to attackers who can monitor network channels. Attackers can perform passive eavesdropping to intercept data or employ active Man-in-the-Middle (MITM) attacks to manipulate data, potentially altering app behavior or injecting malicious content.


Title should maybe be aligned with MASWE-0048? (Insecure Non-HTTP Traffic)? So "Insecure HTTP Traffic" would be better.

Suggested change

When data is sent in cleartext—without encryption—it becomes accessible to attackers who can monitor network channels. Attackers can perform passive eavesdropping to intercept data or employ active Man-in-the-Middle (MITM) attacks to manipulate data, potentially altering app behavior or injecting malicious content.

When data is sent in cleartext (ie. without encryption) it becomes accessible to attackers who can monitor network channels. Attackers can perform passive eavesdropping to intercept data or employ active Man-in-the-Middle (MITM) attacks to manipulate data, potentially altering app behavior or injecting malicious content.

weaknesses/MASVS-NETWORK/MASWE-0050.md

TheDauntless · 2024-11-07T11:52:06Z

weaknesses/MASVS-NETWORK/MASWE-0050.md

+
+## Modes of Introduction
+
+- **Cleartext Traffic Allowed Globally in Configurations:** Global configuration settings allow cleartext traffic, making all network communication insecure.


Enabling the flag doens't make everything insecure. Everything can be secure even with this flag.

Suggested change

- **Cleartext Traffic Allowed Globally in Configurations:** Global configuration settings allow cleartext traffic, making all network communication insecure.

- **Cleartext Traffic Allowed Globally in Configurations:** Global configuration settings allow cleartext traffic, making insecure APIs available to the developer.

I agree but what do you mean by "insecure APIs available to the developer"?

TheDauntless · 2024-11-07T11:59:14Z

weaknesses/MASVS-NETWORK/MASWE-0051.md

+- **Restrict Network Bindings**: Configure the application to bind only to specific, necessary network interfaces, avoiding the use of wildcard addresses like `INADDR_ANY`.
+- **Implement Strong Access Controls**: Enforce authentication and authorization for any services exposed through open ports to ensure only authorized entities can connect.
+- **Disable Debugging Services in Production**: Ensure that all development and debugging network services are disabled or removed in production builds.
+- **Validate and Sanitize Inputs**: Properly validate all incoming data from network connections to prevent injection attacks and buffer overflows.


I would say that this is irrelevant for this specific weakness.

Could you please explain this a bit more?

TheDauntless · 2024-11-07T11:59:26Z

weaknesses/MASVS-NETWORK/MASWE-0051.md

+- **Implement Strong Access Controls**: Enforce authentication and authorization for any services exposed through open ports to ensure only authorized entities can connect.
+- **Disable Debugging Services in Production**: Ensure that all development and debugging network services are disabled or removed in production builds.
+- **Validate and Sanitize Inputs**: Properly validate all incoming data from network connections to prevent injection attacks and buffer overflows.
+- **Use Secure Communication Protocols**: Employ encryption and secure protocols (e.g., TLS/SSL) for any network communication to protect data in transit.


Also irrelevant for this weakness?

Could you please explain this a bit more?

TheDauntless · 2024-11-07T11:59:58Z

weaknesses/MASVS-NETWORK/MASWE-0052.md


 ---

+## Overview
+
+Applications that do not properly validate SSL/TLS certificates during secure communication are susceptible to man-in-the-middle attacks and other security breaches. This weakness occurs when an application accepts invalid, expired, self-signed, or untrusted certificates without appropriate verification, compromising the integrity and confidentiality of data in transit.


Potentially remove SSL? SSL shouldn't be used anymore.

We could change man-in-the-middle to machine-in-the-middle which is a common new phrase for it to be gender neutral.

weaknesses/MASVS-NETWORK/MASWE-0052.md

Co-authored-by: Jeroen Beckers <info@dauntless.be>

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 suggestion.

Files not reviewed (1)

weaknesses/MASVS-NETWORK/MASWE-0050.md: Evaluated as low risk

Comments skipped due to low confidence (1)

weaknesses/MASVS-NETWORK/MASWE-0049.md:46

The term "NSURLSession" should be "URLSession".

Utilize Platform-Provided Networking APIs: Always use the networking APIs provided by the platform, such as `NSURLSession` for iOS and `HttpsURLConnection` or `OkHttp` for Android, which handle many security concerns internally.

2024-11-22T09:11:38Z

weaknesses/MASVS-NETWORK/MASWE-0049.md

@@ -21,3 +21,29 @@ status: draft

 ---

+## Overview
+
+Applications that do not utilize platform-provided networking APIs or well-established security libraries are susceptible to security vulnerabilities. When developers implement custom networking code or "roll their own" security mechanisms, they risk introducing flaws due to a lack of deep expertise in cryptography and network security. Platform-provided APIs and libraries, such as `NSURLSession` on iOS or `HttpsURLConnection` on Android, are designed and maintained by experts, incorporating security best practices and regular updates to address new threats and vulnerabilities.


The phrase "roll their own" should be "roll-your-own".

Suggested change

Applications that do not utilize platform-provided networking APIs or well-established security libraries are susceptible to security vulnerabilities. When developers implement custom networking code or "roll their own" security mechanisms, they risk introducing flaws due to a lack of deep expertise in cryptography and network security. Platform-provided APIs and libraries, such as `NSURLSession` on iOS or `HttpsURLConnection` on Android, are designed and maintained by experts, incorporating security best practices and regular updates to address new threats and vulnerabilities.

Applications that do not utilize platform-provided networking APIs or well-established security libraries are susceptible to security vulnerabilities. When developers implement custom networking code or "roll-your-own" security mechanisms, they risk introducing flaws due to a lack of deep expertise in cryptography and network security. Platform-provided APIs and libraries, such as `NSURLSession` on iOS or `HttpsURLConnection` on Android, are designed and maintained by experts, incorporating security best practices and regular updates to address new threats and vulnerabilities.

Add overview, impact, modes of introduction, and mitigations

aff363b

cpholguera added MASVS-NETWORK MASWE labels Oct 26, 2024

cpholguera self-assigned this Oct 26, 2024

github-actions bot removed the MASVS-NETWORK label Oct 26, 2024

cpholguera mentioned this pull request Oct 26, 2024

[MASWE-0050] New MASWE Weakness #2690

Open

cpholguera added 3 commits October 28, 2024 19:57

Merge branch 'master' of https://github.com/OWASP/owasp-mastg into ma…

47748e1

…swe-0050

inital drafts

921cb02

Merge branch 'master' of https://github.com/OWASP/owasp-mastg into ma…

a4f1cbd

…swe-0050

cpholguera mentioned this pull request Nov 5, 2024

[MASWE-0048] New MASWE Weakness #2688

Open

cpholguera changed the title ~~Add MASWE-0050~~ Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 Nov 6, 2024

TheDauntless reviewed Nov 7, 2024

View reviewed changes

weaknesses/MASVS-NETWORK/MASWE-0047.md Outdated Show resolved Hide resolved

TheDauntless reviewed Nov 7, 2024

View reviewed changes

weaknesses/MASVS-NETWORK/MASWE-0048.md Outdated Show resolved Hide resolved

TheDauntless requested changes Nov 7, 2024

View reviewed changes

Apply suggestions from code review

6d14422

Co-authored-by: Jeroen Beckers <info@dauntless.be>

cpholguera requested a review from Copilot November 22, 2024 09:10

Copilot AI reviewed Nov 22, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 #2919

Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 #2919

cpholguera commented Oct 26, 2024 •

edited

Loading

TheDauntless Nov 7, 2024

TheDauntless Nov 7, 2024

TheDauntless left a comment

TheDauntless Nov 7, 2024

TheDauntless Nov 7, 2024

TheDauntless Nov 7, 2024

TheDauntless Nov 7, 2024

cpholguera Nov 22, 2024

TheDauntless Nov 7, 2024

cpholguera Nov 22, 2024

TheDauntless Nov 7, 2024

cpholguera Nov 22, 2024

TheDauntless Nov 7, 2024

TheDauntless Nov 7, 2024

Copilot AI left a comment

Copilot AI Nov 22, 2024

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

	When data is sent in cleartext—without encryption—it becomes accessible to attackers who can monitor network channels. Attackers can perform passive eavesdropping to intercept data or employ active Man-in-the-Middle (MITM) attacks to manipulate data, potentially altering app behavior or injecting malicious content.
	When data is sent in cleartext (ie. without encryption) it becomes accessible to attackers who can monitor network channels. Attackers can perform passive eavesdropping to intercept data or employ active Man-in-the-Middle (MITM) attacks to manipulate data, potentially altering app behavior or injecting malicious content.


		## Modes of Introduction

		- Cleartext Traffic Allowed Globally in Configurations: Global configuration settings allow cleartext traffic, making all network communication insecure.

Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 #2919

Are you sure you want to change the base?

Add MASWE-0047, MASWE-0048, MASWE-0049, MASWE-0050, MASWE-0051, MASWE-0052 #2919

Conversation

cpholguera commented Oct 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot AI Nov 22, 2024

Choose a reason for hiding this comment

cpholguera commented Oct 26, 2024 •

edited

Loading