Skip to content

MASWE-0018: Lack of Authentication or Authorization on App Components

MAS Requirement

The app enforces authentication and authorization on its components.

Mappings

MASVS V1: MSTG-PLATFORM-4, MSTG-AUTH-3, MSTG-NETWORK-2, MSTG-STORAGE-6

MASVS V2: MASVS-AUTH-1, MASVS-PLATFORM-1, MASVS-STORAGE-2

CWE: CWE-306: Missing Authentication for Critical Function, CWE-749: Exposed Dangerous Method or Function, CWE-862: Missing Authorization, CWE-863: Incorrect Authorization, CWE-923: Improper Restriction of Communication Channel to Intended Endpoints, CWE-926: Improper Export of Android Application Components, CWE-939: Improper Authorization in Handler for Custom URL Scheme, CWE-940: Improper Verification of Source of a Communication Channel

Android Risks: content-resolver, insecure-broadcast-receiver, access-control-to-exported-components, android-exported, custom-permissions, file-providers

Android Core Quality: Component_Export, Component_Permissions, Component_Protection

Overview

This weakness occurs when app components that expose functionality or data do not enforce proper authentication or authorization on their callers.

It covers any component reachable by other apps or processes without adequate access control, including services, broadcast receivers, activities, and content providers, as well as local web services or open ports exposed by the app. It also covers the handling of authentication material on such surfaces, for example authentication tokens accepted without validation or authentication flows handled insecurely inside WebViews.

Modes of Introduction

  • Unintentionally Exported Components: Exporting services, broadcast receivers, activities, or content providers through defaults or misconfiguration when they are only meant for internal use.
  • Missing or Weak Permissions on Exported Components: Exporting components without permission requirements, with weak protection levels, or with misconfigured custom permissions.
  • Caller Not Verified on IPC Interfaces: Exposing Binder or Messenger interfaces that do not verify the caller's identity or permissions (e.g. not calling checkCallingPermission()).
  • Over-Broad Data Grants: Using sticky broadcasts, over-broad or persistable URI permission grants, or persistent data sharing where one-time, scoped sharing would suffice.
  • Unprotected Local Network Services: Binding a local web service or open port that accepts connections without authentication.
  • Authentication Material Not Validated: Accepting authentication tokens without proper validation (e.g. missing signature or claim checks, no PKCE in OAuth flows) or handling authentication inside WebViews instead of secure system flows.
  • Missing Authentication or Authorization on Deep Links: App-defined URI scheme, Android App Link, or iOS Universal Link triggers a sensitive action (e.g., password reset, fund transfer, account linking) without verifying that the request came from an authenticated or authorized source.

Impact

  • Compromise of Sensitive Data: Attackers can query unprotected content providers or receive broadcast data, resulting in unauthorized disclosure of user or app data to other apps on the device.
  • Authentication or Authorization Bypass: Attackers can invoke privileged functionality, such as internal services or unvalidated token flows, without authenticating, resulting in actions being executed on behalf of the user.
  • Bypass of Protection Mechanisms: Attackers can launch internal activities directly, resulting in the circumvention of intended flows such as authentication screens or paywalls.

Mitigations

  • Do Not Export Components Unnecessarily: Explicitly mark internal components as not exported and keep the exposed surface minimal.
  • Protect Exported Components with Permissions: Guard intentionally exported components with permissions of an appropriate protection level (e.g. signature-level for same-developer apps) and define custom permissions correctly.
  • Verify Callers on IPC Interfaces: Check the caller's identity or permissions on Binder and Messenger interfaces before performing sensitive operations or returning data.
  • Grant Minimal, Short-Lived Data Access: Prefer one-time, narrowly scoped URI grants over persistable ones, avoid sticky broadcasts, and restrict content provider paths to exactly what must be shared.
  • Authenticate Local Services: Avoid opening local ports where possible; if required, authenticate every connection and bind only to the local interface.
  • Validate Authentication Material: Validate tokens server-side (signature, issuer, audience, expiry), use PKCE for OAuth flows, and use system-provided authentication sessions instead of handling credentials inside WebViews.

Knowledge

MASTG-KNOW-0134: Android Broadcast Receivers MASTG-KNOW-0017: App Permissions MASTG-KNOW-0020: Inter-Process Communication (IPC) Mechanisms MASTG-KNOW-0133: Android Services MASTG-KNOW-0132: Android Activities MASTG-KNOW-0117: Android ContentProvider

Tests

MASTG-TEST-0366: Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality MASTG-TEST-0365: Exported And Unprotected Services That Expose Sensitive Functionality MASTG-TEST-0364: Exported And Unprotected Activities That Expose Sensitive Functionality MASTG-TEST-0357: References to Oversharing of File-Based Content Providers MASTG-TEST-0356: Runtime Verification of Unauthorized Database Access through Content Providers MASTG-TEST-0355: References to Unauthorized Database Access through Content Providers

Best Practices

MASTG-BEST-0052: Restrict Access to Android App Components MASTG-BEST-0049: Restrict and Validate Access to Exported Content Providers