Skip to content

MASWE-0046: Use of Deprecated APIs or Functionality

MAS Requirement

The app does not use deprecated APIs or functionality.

Mappings

MASVS V1: MSTG-CRYPTO-4

MASVS V2: MASVS-CODE-3, MASVS-CRYPTO-2

CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm, CWE-477: Use of Obsolete Function, CWE-522: Insufficiently Protected Credentials

Overview

This weakness occurs when an app relies on deprecated APIs or functionality that are no longer maintained, may lack security fixes, or have been superseded by safer alternatives.

APIs may become deprecated for various reasons. This may be due to architectural changes, lack of developer adoption, reduced hardware support, or a better-designed replacement that addresses security shortcomings in the old API. Continuing to use deprecated security-relevant APIs can leave the app exposed to weaknesses that the platform has already addressed. A representative example is the use of deprecated Android KeyStore implementations such as Bouncy Castle (BKS), but this weakness covers deprecated APIs and functionality in general, including cryptography, storage, networking, and platform features.

Modes of Introduction

  • Deprecated Cryptographic Providers: Using deprecated keystore or cryptographic provider implementations (e.g. Bouncy Castle-backed KeyStore on Android) instead of their maintained replacements.
  • Deprecated Platform APIs: Continuing to use platform APIs that have been superseded by safer alternatives with improved security behavior.
  • Deprecation Warnings Ignored: Building with unresolved deprecation warnings, so the use of outdated functionality accumulates unnoticed.

Impact

  • Compromise of Sensitive Data: Attackers can exploit the known shortcomings of deprecated implementations, resulting in exposure of data those APIs were supposed to protect.
  • Authentication or Authorization Bypass: Attackers can abuse weaknesses in deprecated authentication- or keystore-related APIs, resulting in unauthorized access to protected keys or functionality.

Mitigations

  • Migrate Off Deprecated APIs: Replace deprecated APIs with the platform's recommended alternatives as part of regular maintenance. Prioritize migration of security-relevant APIs.
  • Treat Deprecation Warnings as Actionable: Surface deprecation warnings in builds and reviews, and track migrations for security-relevant APIs with priority.
  • Follow Platform Release Notes: Review each platform release's deprecation and behavior-change notes to plan migrations before old functionality is removed or breaks.
  • Test the App on All Supported Platforms: Run the app on all platform API versions supported during development.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0046 mapping, the test titles and a summary of the tests.