Skip to content

MASWE-0036: Unnecessary Exposure of Sensitive Data via the User Interface

MAS Requirement

The app does not unnecessarily expose sensitive data through its user interface.

Mappings

MASVS V1: MSTG-STORAGE-7

MASVS V2: MASVS-PLATFORM-3, MASVS-STORAGE-2

CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when an app exposes sensitive data beyond what is required for the user's current task, or exposes required data without protections proportionate to its sensitivity through its user interface.

The typical exposure path involves displaying secrets or sensitive information in cleartext when masking or a partial representation would suffice, (e.g., using unprotected input fields for passwords or PINs).

Modes of Introduction

  • Non-Secure Text Entry: Building password or PIN fields without inserting them in platform-specific fields that mask sensitive data (e.g. isSecureTextEntry on iOS, textPassword input types on Android), so the input is shown in cleartext.
  • Unmasked Sensitive Values: Displaying full values (e.g. complete card numbers or personal identifiers) where a masked or partial representation would suffice.

Impact

  • Compromise of Sensitive Data: Sensitive information may be observed from the screen and captured by other user.
  • Authentication or Authorization Bypass: Attackers can capture credentials, PINs, or one-time codes exposed through the UI, resulting in unauthorized access to the user's accounts.

Mitigations

Knowledge

MASTG-KNOW-0022: Overlay Attacks MASTG-KNOW-0055: Keyboard Cache MASTG-KNOW-0100: Keyboard Cache MASTG-KNOW-0083: Pasteboard MASTG-KNOW-0121: Text Input Field Masking in iOS MASTG-KNOW-0141: Custom Keyboards

Tests

MASTG-TEST-0340: References to Overlay Attack Protections MASTG-TEST-0258: References to Keyboard Caching Attributes in UI Elements MASTG-TEST-0316: App Exposing User Authentication Data in Text Input Fields MASTG-TEST-0313: References to APIs for Preventing Keyboard Caching of Text Fields MASTG-TEST-0314: Runtime Monitoring of Text Fields Eligible for Keyboard Caching MASTG-TEST-0279: Pasteboard Contents Not Expiring MASTG-TEST-0278: Pasteboard Contents Not Cleared After Use MASTG-TEST-0346: References to APIs Hiding Sensitive Data in Text Input Fields MASTG-TEST-0277: Sensitive Data in the iOS General Pasteboard at Runtime MASTG-TEST-0347: Runtime Use of APIs Hiding Sensitive Data in Text Input Fields MASTG-TEST-0276: Use of the iOS General Pasteboard MASTG-TEST-0280: Pasteboard Contents Not Restricted to Local Device

Best Practices

MASTG-BEST-0040: Preventing Overlay Attacks MASTG-BEST-0019: Use Non-Caching Input Types for Sensitive Fields MASTG-BEST-0026: Preventing Keyboard Caching for Sensitive Text Inputs MASTG-BEST-0044: Mask Sensitive Data in Text Input Fields