Skip to content

MASWE-0048: Malicious Code Included in the App

MAS Requirement

The app package does not contain malicious code.

Mappings

MASVS V2: MASVS-CODE-3

CWE: CWE-506: Embedded Malicious Code, CWE-507: Trojan Horse, CWE-511: Logic/Time Bomb

Overview

This weakness occurs when an app ships with malicious code, introduced either intentionally by an insider or unintentionally through a compromised dependency, SDK, build tool, or other supply-chain attack.

Malicious code can exfiltrate data, execute hidden or backdoored functionality, display unwanted content, or perform actions against the user's interest. Because the developer is responsible for all code shipped in the app, including third-party SDKs, the codebase must be reviewed and the supply chain examined to detect and prevent the inclusion of malicious code. This complements Dependencies with Known Vulnerabilities, which covers dependencies with known vulnerabilities, and Non-Reproducible Builds, which covers the inability to verify what was actually built.

Modes of Introduction

  • Malicious Developer: Malicious code committed intentionally by someone with access to the codebase or through a compromised developer account.
  • Compromised Dependencies: Malicious or trojanized third-party SDKs and libraries pulled into the app, including through typosquatting or hijacked packages.
  • Compromised Build Pipeline: Build tools, plugins, or CI/CD infrastructure that inject code into the app during compilation or packaging.
  • Hidden Functionality: Backdoors, hidden switches, or undisclosed capabilities shipped in the app or its components.

Impact

  • Compromise of Sensitive Data: Attackers can exfiltrate user data and credentials from inside the app's trust boundary, resulting in large-scale disclosure across the entire user base.
  • Execution of Unauthorized Code: Attackers can trigger backdoored or hidden functionality at will, resulting in attacker-controlled behavior running with the app's identity and permissions.
  • Compromise of System Integrity and Business Operations: The app owner distributes malware to their own users, resulting in app-store removal, incident response costs, and severe reputational damage.

Mitigations

  • Review Code and Changes: Enforce code review for all changes, restrict and monitor access to the codebase, and require strong authentication for developer accounts.
  • Examine the Supply Chain: Pin dependency versions, verify package integrity and provenance, source components only from reputable publishers, and monitor them with Software Composition Analysis (see Dependencies with Known Vulnerabilities).
  • Protect the Build Pipeline: Harden and monitor CI/CD infrastructure, restrict who and what can alter build configurations, and generate build provenance attestations (see Non-Reproducible Builds).
  • Analyze the Shipped Artifact: Scan and behaviorally analyze release builds to detect unexpected code, permissions, or network endpoints before distribution.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0048 mapping, the test titles and a summary of the tests.