Skip to main content

Insecure service configuration - usesCleartextTraffic

Description​

The application has android:usesCleartextTraffic set to true, which allows it to access resources that do not use encryption, a situation that could be exploited by an attacker to perform MitM attacks and compromise the confidentiality and integrity of the application.

Impact​

  • Obtain sensitive information through MitM attacks.
  • Modify intercepted information with the aim of deceiving an application user.

Recommendation​

The android:usesCleartextTraffic must be set to false.

Threat​

Attacker without credentials from the same network segment as an application user.

Expected Remediation Time​

⌚ 15 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the src.

Base​

  • Attack vector: A
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: N

Temporal​

  • Exploit code maturity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 3.7
    • Temporal: 3.4
  • Severity:
    • Base: Low
    • Temporal: Low

Score 4.0​

Default score using CVSS 4.0 . It may change depending on the context of the src.

Base 4.0​

  • Attack vector: A
  • Attack complexity: H
  • Attack Requirements: N
  • Privileges required: N
  • User interaction: A
  • Confidentiality (VC): L
  • Integrity (VI): L
  • Availability (VA): N
  • Confidentiality (SC): N
  • Integrity (SI): N
  • Availability (SA): N

Threat 4.0​

  • Exploit maturity: P

Result 4.0​

  • Vector string: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
  • Score:
    • CVSS-BT: 1.1
  • Severity:
    • CVSS-BT: Low

Compliant code​

The application manifest has usesCleartextTraffic set to false

<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:sharedUserId="android.uid.system" android:versionCode="4" android:versionName="1.0" android:usesCleartextTraffic= "False" package="com.android.zerosms">
    <uses-permission android:name="android.permission.SEND_SMS"/>
    <application android:label="@7F040001" android:icon="@7F020002">
        <provider
          android:authorities="com.andriod.databasetest.contentprovider"
          android:name=".db.ContentProviderDb"
          android:exported="false"
          android:grantUriPermissions="true">
        </provider>
    </application>
</manifest>

Non compliant code​

The application manifest has usesCleartextTraffic set to true

<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:sharedUserId="android.uid.system" android:versionCode="4" android:versionName="1.0" android:usesCleartextTraffic= "True" package="com.android.zerosms">
    <uses-permission android:name="android.permission.SEND_SMS"/>
    <application android:label="@7F040001" android:icon="@7F020002">
        <provider
          android:authorities="com.andriod.databasetest.contentprovider"
          android:name=".db.ContentProviderDb"
          android:exported="true"
          android:grantUriPermissions="true">
        </provider>
    </application>
</manifest>

Requirements​

Fixes​

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Last updated on