Skip to content

MASWE-0027: Insecure Certificate Validation

MAS Requirement

The app validates certificates for all network traffic.

Mappings

MASVS V1: MSTG-NETWORK-3

MASVS V2: MASVS-NETWORK-1

CWE: CWE-295: Improper Certificate Validation, CWE-297: Improper Validation of Certificate with Host Mismatch

Android Risks: unsafe-trustmanager, unsafe-hostname

Android Core Quality: Network_Security_Configuration, Security_Provider_Initialization

Overview

This weakness occurs when an app does not properly validate TLS certificates during secure communication, accepting invalid, expired, self-signed, or untrusted certificates without appropriate verification.

Certificate validation is the mechanism through which a TLS client establishes that it is talking to the intended server and not to an intermediary. When it is disabled, weakened, or implemented incorrectly, the confidentiality and integrity guarantees of TLS no longer hold, even though the connection itself is encrypted.

Modes of Introduction

  • Disabling Certificate Validation: Disabling or bypassing certificate validation checks to simplify development or troubleshoot connectivity issues, and shipping that configuration to production.
  • Accepting Self-Signed Certificates: Accepting self-signed or untrusted certificates without proper validation against trusted Certificate Authorities (CAs).
  • Ignoring Hostname Verification: Failing to verify that the certificate's hostname matches the server's hostname.
  • Using Insecure Custom Trust Managers: Implementing custom certificate validation logic that is incomplete, incorrect, or insecure.
  • Incorrect Error Handling: Proceeding with connections even when certificate validation errors occur, without alerting the user or terminating the connection.
  • Third-Party Libraries: Using third-party libraries or SDKs that disable or weaken certificate validation internally, or that default to permissive trust settings.

Impact

  • Compromise of Sensitive Data: Attackers can capture, read, or alter sensitive information transmitted over the network, resulting in unauthorized disclosure or manipulation of user data.
  • Authentication or Authorization Bypass: Attackers can capture credentials or session tokens in transit, resulting in user impersonation and unauthorized access to accounts or backend systems.
  • Compromise of System Integrity and Business Operations: Attackers can impersonate legitimate servers and feed altered or malicious data to the app, resulting in unreliable or malicious app behavior and reputational damage for the app owner.
  • Legal and Regulatory Non-Compliance: Attackers can capture personal data in transit, resulting in reportable breaches and regulatory penalties for the app owner under laws such as GDPR or HIPAA.

Mitigations

  • Enforce Strict Certificate Validation: Always validate TLS certificates against a trusted set of Certificate Authorities (CAs) provided by the operating system or a trusted third party.
  • Avoid Accepting Self-Signed Certificates: Do not accept self-signed or untrusted certificates in production environments unless there is a secure mechanism to trust them explicitly.
  • Enable Hostname Verification: Ensure that the application's network layer verifies the server's hostname against the certificate's Subject Alternative Name (SAN) or Common Name (CN).
  • Use Standard Trust Managers: Utilize well-established libraries and platform-provided APIs for certificate validation instead of custom implementations.
  • Handle Validation Errors Properly: Terminate the connection and alert the user whenever certificate validation fails due to issues like expiration, revocation, or mismatch.

Knowledge

MASTG-KNOW-0014: Android Network Security Configuration MASTG-KNOW-0010: Exception Handling MASTG-KNOW-0011: Security Provider MASTG-KNOW-0072: Server Trust Evaluation

Tests

MASTG-TEST-0285: Outdated Android Version Allowing Trust in User-Provided CAs MASTG-TEST-0282: Unsafe Custom Trust Evaluation MASTG-TEST-0286: Network Security Configuration Allowing Trust in User-Provided CAs MASTG-TEST-0234: Missing Implementation of Server Hostname Verification with SSLSockets MASTG-TEST-0295: GMS Security Provider Not Updated MASTG-TEST-0284: Incorrect SSL Error Handling in WebViews MASTG-TEST-0283: Incorrect Implementation of Server Hostname Verification MASTG-TEST-0397: References to WKNavigationDelegate Bypassing Certificate Validation MASTG-TEST-0396: References to URLSessionDelegate Bypassing Certificate Validation

Best Practices

MASTG-BEST-0021: Ensure Proper Error and Exception Handling MASTG-BEST-0020: Update the GMS Security Provider MASTG-BEST-0073: Properly Validate Server Trust in URLSessionDelegate and WKNavigationDelegate