Skip to content

MASWE-0041: Running on a Recent Platform Version Not Ensured

MAS Requirement

The app detects if it is running on an unsupported OS version and reacts appropriately.

Mappings

MASVS V2: MASVS-CODE-1

CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information, CWE-693: Protection Mechanism Failure, CWE-1104: Use of Unmaintained Third Party Components, CWE-1357: Reliance on Insufficiently Trustworthy Component

Android Risks: strandhogg, unsafe-download-manager

Overview

This weakness occurs when an app does not ensure that it runs on a sufficiently recent platform version, e.g. via minSdkVersion on Android or MinimumOSVersion on iOS.

Ensuring a recent minimum platform version guarantees the availability of security features and components the app relies on, such as hardware-backed key storage, runtime permissions, Network Security Configuration (Android 7.0+), and App Transport Security (iOS 9+), as well as secure WebView behavior. Supporting older versions also exposes users to platform-level vulnerabilities that were fixed in later releases, such as the StrandHogg task-affinity attacks on older Android versions, which the app cannot fix on its own.

Modes of Introduction

  • Low Minimum Version with Modern Assumptions: Setting a low minimum OS version to support older devices while implicitly or explicitly relying on security features (e.g. runtime permissions, hardware-backed keystore, network security policies) that do not exist on those versions.
  • Known-Vulnerable Platform Versions Supported: Allowing the app to run on OS versions affected by relevant, unfixable platform vulnerabilities (e.g. StrandHogg v1/v2 task affinity and allowTaskReparenting abuse on older Android).

Impact

  • Compromise of Sensitive Data: Attackers can leverage missing platform protections or unpatched OS vulnerabilities to reach the app's data, resulting in exposure of user data on outdated devices.
  • Authentication or Authorization Bypass: Attackers can abuse platform flaws such as task hijacking to phish credentials from the app's users on affected versions, resulting in account takeover.

Mitigations

  • Raise the Minimum Platform Version: Set minSdkVersion / MinimumOSVersion high enough that every security feature the app depends on is guaranteed to be present.
  • Gate Sensitive Features by Version: Where supporting older versions is a hard business requirement, detect the platform version at runtime and disable sensitive functionality, or warn and terminate, on versions that cannot provide the required protections.
  • Reassess the Minimum Regularly: Revisit the supported version floor as platform vulnerabilities are published and usage of old versions declines.

Tests

MASTG-TEST-0245: References to Platform Version APIs