d3cfe19d7e
Co-authored-by: Marco Borgeaud <89914223+marco-antognini-sonarsource@users.noreply.github.com>
101 lines
3.8 KiB
Plaintext
101 lines
3.8 KiB
Plaintext
Development tools and frameworks usually have options to make debugging easier for developers. Although these features are useful during development, they should never be enabled for applications deployed in production.
|
|
|
|
Activating a development feature in production can have an important range of consequences depending on its use:
|
|
|
|
* Technical information leak; generally by disclosing verbose logging information to the application's user.
|
|
* Arbitrary code execution; generally with a parameter that will allow the remote debugging or profiling of the application.
|
|
|
|
In all cases, the attack surface of an affected application is increased. In some cases, such features can also make the exploitation of other unrelated vulnerabilities easier.
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The development of the app is completed and the development feature is activated.
|
|
* The app is distributed to end users with the development feature activated
|
|
|
|
There is a risk if you answered yes to any of those questions.
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
Applications should be released without any development feature activated. When such features are required when in
|
|
the development process of the application, they should only apply to a build variant that is dedicated to
|
|
development environments. That variant should not be set as the default build configuration to prevent any unattended development feature exposition.
|
|
|
|
== Sensitive Code Example
|
|
|
|
In ``++AndroidManifest.xml++`` the android debuggable property is set to ``++true++``. The application will therefore be debuggable.
|
|
|
|
[source,xml]
|
|
----
|
|
<application
|
|
android:icon="@mipmap/ic_launcher"
|
|
android:label="@string/app_name"
|
|
android:roundIcon="@mipmap/ic_launcher_round"
|
|
android:supportsRtl="true"
|
|
android:debuggable="true"
|
|
android:theme="@style/AppTheme">
|
|
</application> <!-- Sensitive -->
|
|
----
|
|
|
|
In a `web.config` file, the `customErrors` element's `mode` attribute is set to `Off`. The application will disclose unnecessarily verbose information to its users upon error.
|
|
|
|
[source,xml]
|
|
----
|
|
<configuration>
|
|
<system.web>
|
|
<customErrors mode="Off" /> <!-- Sensitive -->
|
|
</system.web>
|
|
</configuration>
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
In ``++AndroidManifest.xml++`` the android debuggable property is set to ``++false++``:
|
|
|
|
[source,xml]
|
|
----
|
|
<application
|
|
android:icon="@mipmap/ic_launcher"
|
|
android:label="@string/app_name"
|
|
android:roundIcon="@mipmap/ic_launcher_round"
|
|
android:supportsRtl="true"
|
|
android:debuggable="false"
|
|
android:theme="@style/AppTheme">
|
|
</application> <!-- Compliant -->
|
|
----
|
|
|
|
In a `web.config` file, the `customErrors` element's `mode` attribute is set to `On`:
|
|
|
|
[source,xml]
|
|
----
|
|
<configuration>
|
|
<system.web>
|
|
<customErrors mode="On" /> <!-- Compliant -->
|
|
</system.web>
|
|
</configuration>
|
|
----
|
|
|
|
== See
|
|
|
|
* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
|
|
* https://mobile-security.gitbook.io/masvs/security-requirements/0x12-v7-code_quality_and_build_setting_requirements[Mobile AppSec Verification Standard] - Code Quality and Build Setting Requirements
|
|
* https://owasp.org/www-project-mobile-top-10/2016-risks/m10-extraneous-functionality[OWASP Mobile Top 10 2016 Category M10] - Extraneous Functionality
|
|
* https://cwe.mitre.org/data/definitions/215[MITRE, CWE-215] - Information Exposure Through Debug Information
|
|
* https://developer.android.com/studio/publish/preparing[developer.android.com] - Prepare for release
|
|
* https://learn.microsoft.com/en-us/aspnet/web-forms/overview/getting-started/getting-started-with-aspnet-45-web-forms/aspnet-error-handling[learn.microsoft.com] - ASP.NET Error Handling
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|