Skip to content

MASWE-0063: Debug Mechanisms Not Disabled

MAS Requirement

The app disables debug mechanisms.

Mappings

MASVS V1: MSTG-RESILIENCE-2

MASVS V2: MASVS-RESILIENCE-4, MASVS-PLATFORM-2

CWE: CWE-489: Active Debug Code

Android Risks: android-debuggable

Overview

This weakness occurs when the application has debug mechanisms enabled in production builds, allowing the usage of platform debuggers, or exposes embedded web or JavaScript content to developer inspection tools.

Mobile apps can include configuration flags and mechanisms that enable debugging. While these are essential during development, leaving them enabled in production makes the app inspectable and manipulable.

On Android, application debugging is controlled by the android:debuggable value in the app's Android Manifest. On iOS, application debuggability is not controlled by an Info.plist key. It depends on the get-task-allow entitlement in the signed application, which is normally enabled for development-signed builds and disabled for distribution-signed builds.

Beyond the application-level debuggable flag, this weakness also covers web-content debugging, which lets a remote inspector attach to the app's web content (e.g. Android's WebView.setWebContentsDebuggingEnabled(true) or iOS's WKWebView.isInspectable).

Modes of Introduction

  • Misconfigured Build Settings: Accidentally leaving the app in a debuggable state through improper selection of build variants, errors in CI/CD configurations, or mistakenly applying debug settings to production environments.
  • WebView or JavaScript Debugging Enabled: Leaving WebView content debugging enabled in production (e.g. setWebContentsDebuggingEnabled(true) on Android or isInspectable = true on iOS).

Impact

  • Compromise of Sensitive Data: Attackers can read the app's memory and logs to obtain encryption keys, API keys, user credentials, or tokens that are never written to the app's code or disk, resulting in unauthorized disclosure of secrets and user data.
  • Authentication or Authorization Bypass: Attackers can manipulate the app's execution flow to skip authentication and authorization checks, resulting in unauthorized access to protected functionality.
  • Facilitated Reverse Engineering and Instrumentation: Debug access reduces the effort required to observe and manipulate the application's behavior and may facilitate further dynamic analysis or instrumentation.

Mitigations

  • Disable Application Debugging in Release Builds: Ensure that the debuggable flag in the app's configuration file is not enabled for production builds. For example, set isDebuggable = false or debuggable false in Android or ensure that the get-task-allow entitlement is absent or set to false in iOS applications.
  • Disable WebView and JavaScript Content Debugging in Release Builds: Ensure that the WebViews and JavaScript contexts in the application are not debuggable. For example, do not call setWebContentsDebuggingEnabled(true) on Android and keep WKWebView.isInspectable set to false on iOS.

Knowledge

MASTG-KNOW-0028: Anti-Debugging MASTG-KNOW-0007: Debuggable Apps MASTG-KNOW-0062: Debuggable Apps

Tests

MASTG-TEST-0227: Debugging Enabled for WebViews MASTG-TEST-0226: Debuggable Flag Enabled in the AndroidManifest MASTG-TEST-0261: Debuggable Entitlement Enabled in the entitlements.plist

Best Practices

MASTG-BEST-0008: Debugging Disabled for WebViews MASTG-BEST-0007: Debuggable Flag Disabled in the AndroidManifest