From 5fb602f11216a270c867c3e28928c30d3c47611b Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Wed, 24 Sep 2025 17:13:58 +0200 Subject: [PATCH 1/6] App placeholders for 3rd party libs --- weaknesses/MASVS-PRIVACY/MASWE-xxxA.md | 14 ++++++++++++++ weaknesses/MASVS-PRIVACY/MASWE-xxxB.md | 14 ++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 weaknesses/MASVS-PRIVACY/MASWE-xxxA.md create mode 100644 weaknesses/MASVS-PRIVACY/MASWE-xxxB.md diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md new file mode 100644 index 0000000..29b88b7 --- /dev/null +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md @@ -0,0 +1,14 @@ +--- +title: Sensitive Data Leaked via Embedded Libraries +id: MASWE-xxxA +alias: data-leak-libraries +platform: [android, ios] +profiles: [L1, L2] +mappings: + masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] +cwe: [200, 359] +draft: + description: Embedded third-party libraries (e.g. analytics, advertising, or crash reporting) can leak sensitive data to external services. Review the usage of embedded libraries to ensure they do not leak sensitive data outside of the expected SLA. +status: placeholder + +--- diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md new file mode 100644 index 0000000..0d3cc49 --- /dev/null +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md @@ -0,0 +1,14 @@ +--- +title: Sensitive Data Leaked via Malicious Embedded Libraries +id: MASWE-xxxA +alias: data-leak-malicious-libraries +platform: [android, ios] +profiles: [???] +mappings: + masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] +cwe: [200, 359] +draft: + description: Any embedded third-party library can act as inadvertently or maliciously leak sensitive data to external services, i.e. after an version update, or an issue in the supply chain. These libraries have access to e.g. ApplicationContext on Android or the full app memory on iOS. This gives them access to read data stored on the disk or in memory and thus could act as an insider threat within the app's process and boundaries. Apply supply chain security best practices to ensure the integrity of embedded libraries. +status: placeholder + +--- From 047f4647032058e91c039f5cd0565d1764ba792e Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Wed, 24 Sep 2025 17:14:59 +0200 Subject: [PATCH 2/6] Fix placeholder id --- weaknesses/MASVS-PRIVACY/MASWE-xxxB.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md index 0d3cc49..811fe23 100644 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md @@ -1,6 +1,6 @@ --- title: Sensitive Data Leaked via Malicious Embedded Libraries -id: MASWE-xxxA +id: MASWE-xxxB alias: data-leak-malicious-libraries platform: [android, ios] profiles: [???] From c697cd14523d993dac44543c79fa59be2aab55d5 Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Thu, 13 Nov 2025 11:17:23 +0100 Subject: [PATCH 3/6] Update MASWE-xxxA.md --- weaknesses/MASVS-PRIVACY/MASWE-xxxA.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md index 29b88b7..87ef23f 100644 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md @@ -3,12 +3,12 @@ title: Sensitive Data Leaked via Embedded Libraries id: MASWE-xxxA alias: data-leak-libraries platform: [android, ios] -profiles: [L1, L2] +profiles: [P] mappings: masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] cwe: [200, 359] draft: - description: Embedded third-party libraries (e.g. analytics, advertising, or crash reporting) can leak sensitive data to external services. Review the usage of embedded libraries to ensure they do not leak sensitive data outside of the expected SLA. + description: Embedded third-party libraries (e.g. analytics, advertising, or crash reporting) can leak sensitive data to external services. Review the usage of embedded libraries to ensure they do not leak sensitive data outside of the expected SLA. This targets user Privacy. MASWE-0076 tests security. status: placeholder --- From 61b19afeee19b074ad789b7dc2eed5568404861d Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Thu, 13 Nov 2025 11:19:40 +0100 Subject: [PATCH 4/6] Revise MASWE-xxxB for malicious library risks Updated title and description for clarity and specificity regarding malicious libraries leaking sensitive data. Adjusted profiles and added mention of SBOM checks. --- weaknesses/MASVS-PRIVACY/MASWE-xxxB.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md index 811fe23..93ec697 100644 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md @@ -1,14 +1,14 @@ --- -title: Sensitive Data Leaked via Malicious Embedded Libraries +title: Dependencies Know to be Malicious id: MASWE-xxxB alias: data-leak-malicious-libraries platform: [android, ios] -profiles: [???] +profiles: [L1,L2] mappings: masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] cwe: [200, 359] draft: - description: Any embedded third-party library can act as inadvertently or maliciously leak sensitive data to external services, i.e. after an version update, or an issue in the supply chain. These libraries have access to e.g. ApplicationContext on Android or the full app memory on iOS. This gives them access to read data stored on the disk or in memory and thus could act as an insider threat within the app's process and boundaries. Apply supply chain security best practices to ensure the integrity of embedded libraries. + description: Embedded third-party libraries known to be malicious can leak sensitive data to external services. These libraries have access to e.g. ApplicationContext on Android or the full app memory on iOS. This gives them access to read data stored on the disk or in memory and thus could act as an insider threat within the app's process and boundaries. Apply supply chain security best practices to ensure the integrity of embedded libraries such as SBOM checks. status: placeholder --- From 3d936bf4f368581857d5fed957f6f0703a23da47 Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Fri, 14 Nov 2025 09:47:21 +0200 Subject: [PATCH 5/6] Update weaknesses/MASVS-PRIVACY/MASWE-xxxB.md Co-authored-by: Carlos Holguera --- weaknesses/MASVS-PRIVACY/MASWE-xxxB.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md index 93ec697..0548089 100644 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md @@ -1,5 +1,5 @@ --- -title: Dependencies Know to be Malicious +title: Dependencies Known to be Malicious id: MASWE-xxxB alias: data-leak-malicious-libraries platform: [android, ios] From c215816c7e15500c45a95612f20204956797d23d Mon Sep 17 00:00:00 2001 From: Dionysis Lorentzos Date: Mon, 17 Nov 2025 19:06:59 +0200 Subject: [PATCH 6/6] Revise MASWE-xxxB to clarify risks of embedding malicious third-party libraries --- weaknesses/MASVS-PRIVACY/MASWE-xxxA.md | 14 -------------- weaknesses/MASVS-PRIVACY/MASWE-xxxB.md | 7 ++++--- 2 files changed, 4 insertions(+), 17 deletions(-) delete mode 100644 weaknesses/MASVS-PRIVACY/MASWE-xxxA.md diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md deleted file mode 100644 index 87ef23f..0000000 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxA.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -title: Sensitive Data Leaked via Embedded Libraries -id: MASWE-xxxA -alias: data-leak-libraries -platform: [android, ios] -profiles: [P] -mappings: - masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] -cwe: [200, 359] -draft: - description: Embedded third-party libraries (e.g. analytics, advertising, or crash reporting) can leak sensitive data to external services. Review the usage of embedded libraries to ensure they do not leak sensitive data outside of the expected SLA. This targets user Privacy. MASWE-0076 tests security. -status: placeholder - ---- diff --git a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md index 0548089..f31cdab 100644 --- a/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md +++ b/weaknesses/MASVS-PRIVACY/MASWE-xxxB.md @@ -5,10 +5,11 @@ alias: data-leak-malicious-libraries platform: [android, ios] profiles: [L1,L2] mappings: - masvs-v2: [MASVS-PLATFORM-3, MASVS-STORAGE-2] -cwe: [200, 359] + masvs-v2: [MASVS-CODE-3] +cwe: [829] draft: - description: Embedded third-party libraries known to be malicious can leak sensitive data to external services. These libraries have access to e.g. ApplicationContext on Android or the full app memory on iOS. This gives them access to read data stored on the disk or in memory and thus could act as an insider threat within the app's process and boundaries. Apply supply chain security best practices to ensure the integrity of embedded libraries such as SBOM checks. + description: | + Embedding third-party libraries known to be malicious may be risky. Such libraries act as an insider threat from within the app's process and boundaries. To mitigate apply chain security best practices, such as Software composition analysis (SCA) (generate a Bill of Materials (BOM), which is then compared against a variety of databases) to ensure the integrity of embedded libraries. status: placeholder ---