Skip to content

MASWE-0002: Sensitive Data Stored With Insufficient Access Restrictions in Internal Locations

Content in BETA

This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).

Send Feedback

Draft Weakness

This weakness hasn't been created yet and it's in draft. But you can check its status or start working on it yourself. If the issue has not yet been assigned, you can request to be assigned to it and submit a PR with the new content for that weakness by following our guidelines.

Check our GitHub Issues for MASWE-0002

Initial Description or Hints

Sensitive data may be stored in internal locations without ensuring exclusive app access (e.g. by using the wrong file permissions) and may be accessible to other apps.

Relevant Topics

  • File permissions (Android)
  • improperly configured FileProvider (Android)
  • Avoid the deprecated MODE_WORLD_WRITEABLE and MODE_WORLD_READABLE modes for IPC files, see https://developer.android.com/privacy-and-security/security-tips#internal-storage. They don't provide the ability to limit data access to particular applications, and they don't provide any control of data format. If you want to share your data with other app processes, consider using a content provider instead, which offers read and write permissions to other apps and can make dynamic permission grants on a case-by-case basis.

References

MASTG v1 Coverage