mobile-code-quality

Mobile Code Quality

What Is Broken and Why

Mobile code quality vulnerabilities arise from using deprecated/unsafe APIs, failing to validate input from local storage or IPC, insecure object deserialization, and shipping with exploitable native code. SQL injection via string-concatenated SQLite queries is common. WebViews that load arbitrary URLs without scheme/host validation allow navigation to attacker-controlled content. Java/Kotlin deserialization of untrusted Parcelables or ObjectInputStream can lead to type confusion and arbitrary code execution. Native code (JNI/NDK) compiled without stack canaries, PIE, or NX creates exploitable memory corruption conditions.

Key Signals

• rawQuery("SELECT * FROM users WHERE id='" + userInput + "'") — string-concatenated SQL
• webView.loadUrl(intent.getStringExtra("url")) — unvalidated URL load
• ObjectInputStream.readObject() on data from Intent extras or ContentProvider
• NSKeyedUnarchiver.unarchiveObject(with:) without class whitelist (iOS < 12)
• Native library without PIE: checksec --file=libapp.so shows No PIE
• Gradle implementation dependency with published CVE in OSS Index
• targetSdkVersion below 30 — misses numerous security improvements
• Implicit Intent used to send sensitive data: sendBroadcast(Intent("ACTION")) without package target
• No version check / forced update mechanism — vulnerable older versions remain in production

Methodology

SQL Injection:

1. Identify SQLite query construction in decompiled code — search for rawQuery, execSQL with + concatenation
2. Trace input sources: Intent extras, ContentProvider queries, user input fields
3. Test: inject ' OR '1'='1 via deep link parameter or IPC

WebView URL loading:

1. Find all webView.loadUrl() / WKWebView.load(URLRequest) calls
2. Trace the URL source — does it come from user input, Intent, or remote config?
3. Inject javascript: or file:// scheme payloads

Deserialization:

1. Search for ObjectInputStream, Parcel.readValue, NSKeyedUnarchiver in source
2. Check if input is from untrusted source (Intent extras, network, files)
3. Attempt to pass crafted gadget chain via Intent Parcelable extra